tosdr-in-action-i-have-read-and-agree.html

<h1 id="tosdr-in-action">ToS;DR in Action</h1>
<p>During the month of June, the ToS;DR team is collaborating with the BBC on their <a href="http://www.bbc.co.uk/programmes/b006tgy1" title="BBC Radio 4Law in Action">“Law in action” programme</a> for a 4-show series dedicated to the <a href="http://tosdr.org/topics.html" title="Topics covered by ToS;DR">topics</a> of terms of service and privacy policies.</p>
<p>On June 4, <a href="http://www.rozenberg.net/">Joshua Rozenberg</a>, Julia Hörnle from Queen Mary University, Jimm, and I talked about what is the probably most unavoidable topic when it comes to terms of service. You can already listen to the <a href="http://downloads.bbc.co.uk/podcasts/radio4/law/rss.xml">podcast</a> on the BBC site. Stay tuned for the next topics, on each Tuesday at 4 pm UK time.</p>
<h2 id="i-have-read-and-agree-to-the-terms-why-is-that-what-we-call-the-biggest-lie-on-the-web">“I have read and agree to the terms”: Why is that what we call the biggest lie on the Web?</h2>
<p>See at 0m53s. <a href="http://www.youtube.com/watch?v=lbvwZ4LWeEc&amp;t=0m53s">Video: Eddie Izzard on how iTunes terms change all the time</a></p>
<p>This is a sensitive topic, and it boils down to consent. Consent is a pretty common condition to form binding agreements around the world, but what is it exactly? Clicking “I agree to the terms” or checking that little box: what are the implications?</p>
<p>First, there's absolutely no denying that in its current state, the terms of service acceptance mechanism is deeply broken, for two obvious reasons:</p>
<ul>
<li>the terms of service and privacy policies are <em>too long</em> and often do not provide shorter versions, nor do they provide <em>plain-English</em> versions either;</li>
<li>the average user signs up to lots and lots of online services, sometimes agreeing to multiple documents or services at once because of <a href="http://tosdr.org/topics.html#third" title="ToS;DR about third parties in terms">third parties</a> that can be involved.</li>
</ul>
<p>In 2008, <a href="http://lorrie.cranor.org/#publications">Lorrie Cranor</a> from Carnegie Mellon estimated that it would take 244 hours every year for each individual to read the privacy policies they agree to online. (<a href="http://www.theatlantic.com/technology/archive/2012/03/reading-the-privacy-policies-you-encounter-in-a-year-would-take-76-work-days/253851/">The Atantic: 76 work days to read all the terms</a>).</p>
<div class="figure">
<img src="tosdr-in-action-i-have-read-and-agree/books.jpg" title="UK consumer org “Which?” comparing lenghts" alt="From http://conversation.which.co.uk/technology/length-of-website-terms-and-conditions/" /><p class="caption">From http://conversation.which.co.uk/technology/length-of-website-terms-and-conditions/</p>
</div>
<p>Second, these two problems are multiplied by the facts that:</p>
<ul>
<li>terms of service and privacy policies change <em>all the time</em> and it's very, very hard to keep track of all of them (although we're trying really hard to solve this by building <a href="http://tosdr.github.io/ToSBack3" title="ToSBack3 is currently in development">ToSBack</a>)</li>
<li>some services, including major ones, do not even commit to a legal obligation of notifying their users of such changes.</li>
</ul>
<p>Since 2007, Facebook has brought major changes to their longer-than-the-US-Constitution-terms-of-service about <a href="https://www.eff.org/deeplinks/2010/04/facebook-timeline" title="EFF: Facebook terms, a timeline">every year</a>. Among the services that do not make it an obligation to notify users of changes: Microsoft, Yahoo!, Skype, Amazon, YouTube.</p>
<p>(Ironically, it seems that the Yahoo! privacy policy has been changed to now make it an obligation to notify users of modifications; however, I do not remember having received notification of this change, although this is the kind of email I pay attention to for ToS;DR. Anyway, I'll have to update <a href="http://tosdr.org/#yahoo">#yahoo</a>).</p>
<p><a href="http://www.apple.com/legal/internet-services/itunes/us/terms.html">Apple iTunes US terms state</a>:</p>
<blockquote>
<p>Apple reserves the right at any time to modify this Agreement and to impose new or additional terms or conditions on your use of the iTunes Service. Such modifications and additional terms and conditions will be effective immediately and incorporated into this Agreement. Your continued use of the iTunes Service will be deemed acceptance thereof.</p>
</blockquote>
<div class="figure">
<img src="tosdr-in-action-i-have-read-and-agree/itunes-agree.jpg" title="Do you agree?" alt="Screenshot of iTunes ToS" /><p class="caption">Screenshot of iTunes ToS</p>
</div>
<h2 id="but-are-long-tos-legal-is-it-enforceable">But are long ToS legal, is it enforceable?</h2>
<p>Before answering these questions, we need to stop for a minute.</p>
<ul>
<li>Courts in different jurisdictions under different laws may come to different conclusions regarding these practices, especially about whether changing terms without notifying users is acceptable or not.</li>
<li>Just because you live in a society that is usually more protective about your rights, it does not mean you're safe, because a lot of the terms of service have <a href="http://tosdr.org/topics.html#jurisdiction-law">choice of law clauses</a></li>
<li>Even when such practices would be deemed illegal, it does not mean that they are not doing any harm. Quite on the contrary, if you've got to go see a judge (i.e., taking the burden of litigation on you in time and/or money) it probably means that harm's been done already. Good contracts do not provoke litigation; they ease private relationships.</li>
<li>And sometimes, even when companies have been fined for practices that have been considered illegal, they have still succeeded in profiting from their actions.</li>
</ul>
<p>Julia Hörnle put it nicely on the show: “They're getting away with it.”</p>
<p>Now, about terms that can change without notification to you, I suppose they are valid in the US, but they're usually not valid in Europe (which does not prevent companies providing services in Europe to have such clauses in their terms and to continue not to notify users…).</p>
<p>For those interested, there are interesting cases in the UK:</p>
<ul>
<li>Parker v. South Eastern Railway Company (1877)</li>
<li>Thornton v. Shoe Lane Parking (1970)</li>
</ul>
<p>In France, consent is part of the four conditions necessary to be forming a valid contract (article 1108 of the Code Civil). The question is then if the terms of service on websites can be considered &quot;reasonable notice&quot;, and thus be enforceable to the user that has agreed to them. A <a href="http://www.legalis.net/spip.php?page=jurisprudence-decision&amp;id_article=3534">recent French supreme court decision</a> implies that the acceptance of ToS requires notified consent; merely hosting the ToS online does not create a contractual obligation.</p>
<p>There was also an <a href="http://www.mondaq.com/canada/x/241354/Terms+of+Service+and+Deceased+Users+Account">interesting case in Canada</a> in which the heirs of a deceased person wanted access and ownership of their brother's email account at Yahoo. One of the questions was around: were the changes to the terms reasonably communicated to the user?</p>
<p>In the European Commission's new data protection regulation currently under review by the European Parliament and the European Council, there's a proposal that the burden of proof of consent be on the service provider.</p>
<p>And that gets me to my last point about consent. In the end, I still have no clear idea what consent actually means in the reality of online services today.</p>
<p>While we have the personal data 1995 directive in the European Union, it seems that there's no enforced consensus at this point about what actually constitutes consent to personal data processing. On the one hand, data protection authorities want to promote interpretations that are in favour or users' privacy. On the other hand, I don't see much happening on how services deal with their users' consent. Let's hope the next regulation will clarify that, and hopefully, not result in less protection or in meaningless consent (see for instance the intense lobbying over the proposed requirement that consent be expressed consent).</p>
<div class="figure">
<img src="tosdr-in-action-i-have-read-and-agree/eudatap.jpg" title="Data protection logo" /><p class="caption"></p>
</div>
<p>Oh, I forgot to answer the question. No, some of these terms are actually illegal:</p>
<ul>
<li><a href="http://www.wired.co.uk/news/archive/2013-01/29/whatsapp-privacy">WhatsApp breached data privacy laws by storing non-user contact details</a></li>
<li><a href="http://www.onlinelaw.de/de/aktuelles/it_news.php?we_objectID=324&amp;pid=0">German Court rules Facebook original Friendfinder and various terms and conditions to be illegal (Landgericht Berlin, Urteil vom 6. März 2012, Az. 16 O 551/10)</a></li>
<li><a href="http://www.bloomberg.com/news/2013-05-07/apple-s-customer-data-privacy-rules-struck-down-by-german-court.html">Apple’s Customer Data-Privacy Rules Struck Down by German Court</a></li>
</ul>
<hr />
<p>So, right now, it's fair to assume that if you clicked &quot;I agree&quot; that means you consent presumably to what's written in the terms; even if that involves <a href="http://www.huffingtonpost.com/2010/04/17/gamestation-grabs-souls-o_n_541549.html" title="It happened on April 1">selling your soul</a>.</p>
<p>What's problematic is that although terms of service are kinds of non-negotiated contracts, they're still a two-way relationship. There are meaningful things written in there, about your rights and obligations as well, to which you presumably consent.</p>
<p>Every once in a while, when a service brings major changes to their terms, we see some media coverage and sometimes outrage at what services can do or aim to do with our personal data or with our creative content. So, we can assume that <em>people do care</em> about these issues; yet, the I-agree-to-the-terms-circus goes on and on.</p>
<p>My assumption then, is that when we discuss privacy and surveillance in our society today, especially in the context of legal regulation or legal reform, we ought to be careful before making statements about what people supposedly consent to.</p>
<p>Just because Facebook is popular, it doesn't mean Facebook users are actually aware and agree to their practices. Thus, assuming that people are ready to “trade-off” some of their freedom from surveillance in exchange for liking and commenting on pictures, is a very big assumption to make about how people value their privacy and their rights.</p>
<p>Quite to the contrary, I would say we have very little idea in general about what's happening to our rights online and how we're <a href="http://blogs.fsfe.org/hugo/2013/05/whos-tracking-me-online-the-most-google-or-facebook/">being tracked</a>. Hopefully, ToS;DR can fix some of that.</p>