Click With Caution: User Licenses Get Tough

Andrew Brandt, PCWorld.com

Microsoft's recent hasty revision of its terms-of-use policy for its Passport product last week is just the latest--and possibly most dramatic--reaction to a growing consumer revolt against vendors who try to impose ridiculously lopsided use agreements on their customers.

Most people never read these documents, called End User License Agreements or Terms of Service. Until recently, there was probably not much reason for most to do so: They were confusing, rarely invoked, and varied wildly among vendors. Even when customers read the EULA or TOS, they rarely complained about the document's terms because little of the content demanded attention.

So why has the "fine print" suddenly become a cause célèbre? It's because since mid-2000 states have been adopting a set of national e-commerce rules called the Uniform Computer Information Transactions Act. The document is a commercial code for software licenses and other computer information transactions. It was produced by the National Conference of Commissioners, an organization of legislators, judges, law professors, and attorneys from every state, who produce the uniform state commercial laws.

Post-UCITA, companies are using far more restrictive language in their EULA documents. Some agreements let the software maker perform highly invasive scans of the user's system. They may limit the methods by which consumers can resolve disputes, or even restrict customers from complaining publicly about a product.

Customers Push Back

Consumers' angry reaction to some of these new rules has been swift: In recent months Juno, Adobe, Verant, and now Microsoft have been among a number of companies that have felt the sting of a backlash against particularly unreasonable licensing terms for the use of software and web services.

Some consumer groups argue that the most restrictive clauses violate the customer's right to privacy and, potentially, the right to free speech. Vergil Bushnell, e-commerce analyst for the advocacy group Consumer Project on Technology, charges that UCITA's unclear language gives companies free reign to craft egregious terms into their EULAs.

"The drafters of UCITA adopted nebulous standards, rejecting more specific language that would have ruled out contractual restrictions on free expression," Bushnell says. "UCITA...give[s] software publishers wide latitude to incorporate one-sided and oppressive language into their contracts," Bushnell says. Several vendors declined comment on this hot topic.

Many factors seem to be in play, including vendors anticipating state ratification of the new federal e-commerce rules. (Only states have the power to make laws governing commerce, which is why UCITA isn't the law of the entire land. So far only Virginia and Maryland have added UCITA rules to their state laws.) But in many cases, the software companies seem to be playing the game as though they're both player and referee, in some cases setting the rules to their own advantage, even though they violate long-standing precepts such as fair use or free speech.

Licenses Get More Complex

Virtually all software programs, and most Web sites that require registration, offer consumers a EULA or TOS contract. These contracts are legally binding documents that provide information about how the publisher will support the product, and include a disclaimer of liability.

They're similar to shrink-wrap licenses for packaged software. Those state that by opening a shrink-wrapped package, you've agreed to abide by the license agreement within. On the Web and in downloaded software, so-called click-wrap agreements require you to click an "I Accept" button located at the end of the agreement before you can use the service or install the software.

"Mass-market click-wrap license agreements are inherently 'contracts of adhesion,' meaning the consumer's negotiating power is limited to 'take it or leave it,'" says CPT's Bushnell. He notes that "if you scrutinize the legalese governing many Internet services, the owner is often allowed the ability to change contractual terms without notice to the consumer."

Click-wrap has its place, however. Consumers want to download software, and vendors want some way to secure their own licensing rights.

"Online agreements are enforceable if they're done right," says Brian Burr, a technology transactions lawyer with the law firm Orrick, Herrington & Sutcliffe. And just in case there was a lawsuit, software companies have tweaked the user interface of EULA mechanisms to force you to at least try to look at the text. Many EULAs now require a user to scroll through the document to get to the "I Accept" button; some companies require users to click on checkboxes or otherwise indicate that they've read--or at least lingered near--the clauses within.

Microsoft's Backlash

Microsoft denies any devious intentions in its reviled EULA policy, which granted the company and its unspecified affiliates the right to "use, modify, copy, distribute, transmit, publicly display" and take other actions with any messages, files, or data entered by users into the Passport Web site.

Microsoft simply hadn't updated the terms of use to be appropriate for its new Passport service, which is intended to make life easier for frequent Web shoppers. Using Passport, you can register a single name and password that works at numerous Web sites, eliminating the need to re-register at every site. But the Passport EULA policy seemed to go far beyond the functions of the service.

"We were in error for having that up there," says Tom Pilla, a Microsoft spokesperson. Microsoft hadn't updated the Passport terms of use to reflect its business policies, or even to be compatible with Passport's current privacy statement, he says.

But Microsoft's Passport terms of service had contained the user-unfriendly language since the service launched in October 1999. Only after a few well-read Netizens brought up the issue did anyone take note. They raised a din, and Microsoft changed the fine print, dodging a negative PR bullet.

Because Passport will be an integral part of Microsoft's proposed HailStorm application- and data-hosting service, critics charge Microsoft was positioning itself to take control of anything you stored on its servers, from business plans to fiction writing to financial records.

Other Offenders Chastened

Not that Microsoft is alone in its contractual expectations. Terms of service for Web sites run by Disney, for example, maintain a similarly strict policy. It states that Disney "shall exclusively own all now known or hereafter existing rights to the Submissions of every kind and nature throughout the universe and shall be entitled to unrestricted use of the Submissions for any purpose whatsoever."

However, Disney representatives note that its TOS agreement pertains to its message boards alone.

Some companies, like Adobe, suffered a much quicker backlash. Last December, when Adobe released its free Glassbook Reader software, it included a free copy of Lewis Carroll's Alice In Wonderland.

The software had been available for only a few days when a careful reader, Art Medlar, noted that the EULA accompanying the book prohibited users from reading the famous children's tale aloud. Customers complained, and within a day Adobe reworked its license agreement. Now, it permits reading the story aloud privately, but still prohibits users from selling admission to a public reading.

Policies Clarified

Similar contract changes were imposed in March by Juno, the free Internet service provider. Juno amended its TOS to say that customers of its free service might be required to install software that lets Juno perform calculations on its customers' PCs while a screensaver program runs. Many longtime Juno customers were furious.

"If they insist on enforcing it, I will be looking for a new ISP," wrote PC World reader John Marson, echoing the sentiments of many irate Juno customers. The company quickly clarified that participation in the program is strictly voluntary for now.

In March, journalists were stunned to discover a EULA clause accompanying Network Associates' latest version of McAfee VirusScan that challenges free speech, Bushnell says.

"The EULA contains two clauses which contain language that would presumably prevent users--or journalists--from publishing benchmark tests or reviews of the software without prior permission from the software publisher," Bushnell adds. Consequently, at least one publication has declined to review the product.

Software maker Verant Interactive also quickly scrapped plans for a monitoring tool imposed on users of the online game Everquest. Citing the proliferation of cheating tools, Verant proposed that players install client software to search hard drives for illicit utilities and report the findings to Verant. Within a day, Verant rescinded the plan. President John Smedley told irate Everquest subscribers "it's the wrong thing to do."

Balancing Privacy, Obligations

Contracts such as EULAs are supposed to be made between willing parties, and need to be negotiable if one side doesn't agree with the terms, attorney Burr says. But some EULA contracts might fall under the definition of a Contract of Adhesion--a legal term that means one party to the agreement has tremendous power, and there's no meaningful way to negotiate the terms.

Of course, anyone can click the "I Decline" button at the bottom of the EULA. But if you do, the software won't install or you won't be permitted to register to use the Web service. The binary nature of the EULA accept-or-decline rules render negotiating contract terms with a software company impossible for the average user.

"The federal digital signature law last year made it clear that click-wrap contracts are enforceable, but there always has to be a meaningful way to say no," Burr says. "Any ambiguities in a contract would likely be interpreted by the courts against the drafter, in this case Microsoft. But I don't think [the TOS terms are] ambiguous; it sounds unconscionable."

Microsoft spokesperson Pilla says the Passport privacy statement would have trumped the erroneous terms of use, but that too may be open to legal debate.

"Another argument people might make against this draconian clause is that it's not properly disclosed under the privacy policy, but there's limits to that because privacy policies only [address] personally identifiable information," Burr counters. "Private data, like an idea for a product, isn't normally [protected]."

Clearly, this is one of those debates that can keep lawyers busy for some time. In the interim, both sides suggest you might be wise to read before you click.

(Tom Mainelli contributed to this report.)