Google Drive and the data ownership panic

Google Drive launched a couple days ago and some new publications are already writing about possible data ownership issues. It’s a common concern whenever a new service launches or website terms and conditions change. Darren Smith pointed me to an article by C|Net titled “Who owns your files on Google Drive?” which had a somewhat confused focus and an unnecessarily alarming conclusion represented by this tagline:

Dropbox and Microsoft's SkyDrive allow you to retain your copyright and IP rights to the work you upload to the service, but Google Drive takes everything you own.

I took a look at Dropbox’s, Microsoft’s and Google’s terms and conditions to test this conclusion.

Dropbox’s terms and conditions

The C|Net post focused on this clause in the Dropbox terms which are only part of the story when it comes to Dropbox’s terms:

By using our Services you provide us with information, files, and folders that you submit to Dropbox (together, “your stuff”). You retain full ownership to your stuff. We don’t claim any ownership to any of it. These Terms do not grant us any rights to your stuff or intellectual property except for the limited rights that are needed to run the Services, as explained below.

This clause clearly states that Dropbox doesn’t claim ownership of your data but the more important set of provisions are those dealing with the license Dropbox takes from its users when it comes to accessing and making use of the data you upload to Dropbox. Bear in mind that all of these services will have a license of some sort. A license is a set of permissions you, as the user, give to the provider and that enables the provider to receive, manipulate and otherwise handle your data. It’s an essential component and nothing to be alarmed by in itself (at least not if you are comfortable with the basic idea of a provider having access to your data as part of your use of the particular service).

Dropbox’s license provisions are pretty vague. Here are the key clauses:

We may need your permission to do things you ask us to do with your stuff, for example, hosting your files, or sharing them at your direction. This includes product features visible to you, for example, image thumbnails or document previews. It also includes design choices we make to technically administer our Services, for example, how we redundantly backup data to keep it safe. You give us the permissions we need to do those things solely to provide the Services. This permission also extends to trusted third parties we work with to provide the Services, for example Amazon, which provides our storage space (again, only to provide the Services).

To be clear, aside from the rare exceptions we identify in our Privacy Policy, no matter how the Services change, we won’t share your content with others, including law enforcement, for any purpose unless you direct us to. How we collect and use your information generally is also explained in our Privacy Policy.

…

Sharing Your Stuff

The Services provide features that allow you to share your stuff with others or to make it public. There are many things that users may do with that stuff (for example, copy it, modify it, re-share it). Please consider carefully what you choose to share or make public. Dropbox has no responsibility for that activity.

The basic idea is clear, though. Dropbox requires your permission to run its service and you agree to give it whatever permissions it requires to do that. The problem with this simplistic approach is that it is too simplistic and vague. As a user you don’t really know what the license’s parameters are beyond whatever is not required to operate the service.

Microsoft Services Agreement

These terms and conditions are not limited to SkyDrive but apply to a range of Microsoft services:

It's a contract that governs your use of any Windows Live, Bing, MSN, Microsoft Office Live, or Office.com services or software, or other Microsoft services or software that directly display or link to this agreement (the "service"). By using or accessing the service, you confirm that you agree to these terms. If you don't agree, don't use the service. Thanks.

This is significant because, unlike with Dropbox where your license relates to a fairly specific service, the license you grant to Microsoft encompasses a variety of services which are increasingly interconnected. This is very similar to Google’s terms (below). These terms and conditions are more specific than Dropbox’s licensing provisions and also contain a statement that Microsoft doesn’t claim ownership of users’ data:

5. Your content

Except for material that we license to you, we don't claim ownership of the content you provide on the service. Your content remains your content. We also don't control, verify, or endorse the content that you and others make available on the service.

You control who may access your content. If you share content in public areas of the service or in shared areas available to others you've chosen, then you agree that anyone you've shared content with may use that content. When you give others access to your content on the service, you grant them free, nonexclusive permission to use, reproduce, distribute, display, transmit, and communicate to the public the content solely in connection with the service and other products and services made available by Microsoft. If you don't want others to have those rights, don't use the service to share your content.

You understand that Microsoft may need, and you hereby grant Microsoft the right, to use, modify, adapt, reproduce, distribute, and display content posted on the service solely to the extent necessary to provide the service.

Please respect the rights of artists, inventors, and creators. Content may be protected by copyright. People appearing in content may have a right to control the use of their image. If you share content on the service in a way that infringes others' copyrights, other intellectual property rights, or privacy rights, you're breaching this contract. You represent and warrant that you have all the rights necessary for you to grant the rights in this section and the use of the content doesn't violate any law. We won't pay you for your content. We may refuse to publish your content for any or no reason. We may remove your content from the service at any time if you breach this contract or if we cancel or suspend the service.

You're responsible for backing up the data that you store on the service. If your service is suspended or canceled, we may permanently delete your data from our servers. We have no obligation to return data to you after the service is suspended or canceled. If data is stored with an expiration date, we may also delete the data as of that date. Data that is deleted may be irretrievable.

A couple things emerge from these terms and conditions. Firstly, when you share your data with other people, you give them a limited license to use your data “solely in connection with the service and other products and services made by Microsoft”. Similarly, the license users grant to Microsoft in respect of their data is limited to permissions required “solely to the extent necessary to provide the service”.

Google’s terms and conditions

Google Drive is governed by Google’s Terms and the license provisions are fairly similar to Dropbox’s and SkyDrive’s, at least when it comes to the basic approach. As with the other two services, Google doesn’t claim ownership of your data. Here are the license provisions:

Your Content in our Services

Some of our Services allow you to submit content. You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours.

When you upload or otherwise submit content to our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content. The rights you grant in this license are for the limited purpose of operating, promoting, and improving our Services, and to develop new ones. This license continues even if you stop using our Services (for example, for a business listing you have added to Google Maps). Some Services may offer you ways to access and remove content that has been provided to that Service. Also, in some of our Services, there are terms or settings that narrow the scope of our use of the content submitted in those Services. Make sure you have the necessary rights to grant us this license for any content that you submit to our Services.

You can find more information about how Google uses and stores content in the privacy policy or additional terms for particular Services. If you submit feedback or suggestions about our Services, we may use your feedback or suggestions without obligation to you.

The license Google users grant to Google is notionally for the “limited purpose of operating, promoting, and improving our Services, and to develop new ones” but it is somewhat open ended in that Google could develop new services or modify existing ones that require your data to be used in ways you couldn’t have anticipated when signing up. This is fairly similar to Microsoft’s Services Agreement which also uses one license for all its services.

What does this all mean?

The C|Net article contains this rather alarming set of statements:

The last sentence makes all the difference. While these rights are limited to essentially making Google Drive better and to develop new services run by Google, the scope is not defined and could extend far further than one would expect.

Simply put: there's no definitive boundary that keeps Google from using what it likes from what you upload to its service.

The chances are Google's terms will never be an issue -- and it is likely over-zealous lawyers making sure Google doesn't somehow get screwed in the long run by a lawsuit -- but it may be enough to push away a great number of entrepreneurs and creative workers who rely on holding on to the rights to their own work.

The fact is, according to its terms, Google may own any code or product you ultimately upload to its new Google Drive service, whether you realise it or not.

These statements, particularly the last one, are factually incorrect and misleading. They are also not uncommon when journalists attempt to navigate terms and conditions without the time or inclination to read them carefully. Google doesn’t claim ownership of its users’ data. Its license is fairly broad and that is understandable given the wide range of services it offers. At the same time, there is scope for the already broad license to be applied in ways users may not have considered. The specific permissions users grant to Google are substantially the same as those users grant to Microsoft (Google is more specific and lists more individual permissions but they are not fundamentally different). 

The big difference here is between Dropbox’s terms, on one hand, and Google’s and Microsoft’s on the other hand. Dropbox offers a fairly specific set of services so users have more certainty as to what they are licensing Dropbox to do with their data. Google and Microsoft offer a range of interconnected services governed by a single legal framework and the potential scope for their licenses is far broader when you consider that their users may be using a variety of Google and Microsoft services with different functionality.

I’ve seen license provisions which are far more onerous in the past. The big culprit back in 2007 was Facebook with this gem:

When you post User Content to the Site, you authorize and direct us to make such copies thereof as we deem necessary in order to facilitate the posting and storage of the User Content on the Site. By posting User Content to any part of the Site, you automatically grant, and you represent and warrant that you have the right to grant, to the Company an irrevocable, perpetual, non-exclusive, transferable, fully paid, worldwide license (with the right to sublicense) to use, copy, publicly perform, publicly display, reformat, translate, excerpt (in whole or in part) and distribute such User Content for any purpose on or in connection with the Site or the promotion thereof, to prepare derivative works of, or incorporate into other works, such User Content, and to grant and authorize sublicenses of the foregoing. You may remove your User Content from the Site at any time. If you choose to remove your User Content, the license granted above will automatically expire, however you acknowledge that the Company may retain archived copies of your User Content.

This license was as close to an assumption of ownership as Facebook has ever come. It was so close to assuming ownership that the difference between ownership and licensing user content was a matter of semantics. The controversies over the Facebook terms did a lot to create more awareness of users’ expectations and what it means to be a better licensor. The current generation of terms and conditions reflect that, for the most part (there are still some shockers). These modern licenses are clearer, limited in varying degrees but are often necessarily broad to enable these services to function effectively. I agree with the one statement in the C|Net article, though –

It always pays to read the fine print.

MXit's inappropriate website terms and conditions language

I have been doing some preparation for a talk I am giving to parents at a school this evening and one of the services I am going to chat about is the popular messaging service, MXit. I came across this wording in MXit's terms and conditions which struck me as somewhat odd:

Unless otherwise stated by MXit in writing, you must be at least 13 (thirteen) years old to make use of the MXit Application, the MXit Websites and the Services. If you are 17 (seventeen) years and younger, but older than 13 (thirteen), you will inform your parents or guardians that you have registered for and are using the Services of MXit and upon request provide reasonable proof that you have complied with this prerequisite for access to the MXit Application and the Services.

Bearing in mind that MXit is popular with teenagers as young as 13 (officially - Mxit, like many social services, is not technically available to children younger than 13), the language used in the phrase "upon request provide reasonable proof that you have complied with this prerequisite for access to the MXit Application and the Services" is not very appropriate given the likely level of comprehension children that age will have. These terms probably don't meet the Consumer Protection Act's plain language requirements either, given the context.

While MXit's terms and conditions inspired this post, I doubt MXit is the only service that has made the mistake of using overly lawyerly jargon in a document which children are, theoretically, going to read and agree with (this is a problematic assumption, complicated by children's limited contractual capacity) before using the service. Enforcing website terms and conditions against children will probably prove to be somewhat challenging and language like this doesn't help at all. Providers should make more of an effort to simplify their language in their terms and conditions both to better comply with the Consumer Protection Act's plain language requirements and improve usability generally.

Add nutmeg to your Terms of Service and whisk briefly

One of my contacts on Google+, York Zucchi, pointed me to his website terms and conditions on his site which I had to share. The terms (well, this is really a liability disclaimer, not a complete set of website terms and conditions) are somewhat simple and not appropriate for all uses but they are a fun read, nevertheless:

IMPORTANT INFORMATION/DISCLAIMER

This website may contain information that is unsuitable for overly sensitive persons with low self-esteem or no sense of humour (you need a great sense of humour to do business in Africa). Any dissemination, a distribution or copying of this website is not only authorised (either explicitly or implicitly) but actively encouraged though not including the source constitutes an irritating social faux pas. If you have landed on this site by mistake we would be curious what you were trying to find online. You are welcome to stick around and read it, even if we didn’t mean for you to visit it. Unless the word absquatulation has been used in its correct context somewhere other than in this warning, it does not have any legal or grammatical use and may be ignored. We take no responsibility for non-enjoyment, either humorous or of informative means, of this website. In the event that you do get the humour herein contained then please note that we take no responsibility for that either. Nor will we accept any liability, tacit or implied, for any damage you may or may not incur as a result of reading, or not, as the case may be, from time to time, notwithstanding all liabilities implied or otherwise, ummm, shucks, where were we.., no matter what happens, IT's NOT, and NEVER WILL BE, OUR FAULT except where we made silly promises that we should not have. No animals were harmed in the writing of this text, although the yorkshire terrier next door is living on borrowed time. Those of you with an overwhelming fear of the unknown will be gratified to learn that there is no hidden message revealed by reading this warning backwards, so just ignore that Alert Notice from Microsoft: However, by pouring a complete circle of salt around yourself and your computer you can ensure that no harm befalls you and your pets. If you have read this whole paragraph in error, please add some nutmeg and eggs and place it in a warm oven for 40 minutes. Whisk briefly and let it stand for 2 hours before icing.

Thanks for the link, York! I particularly like this line:

However, by pouring a complete circle of salt around yourself and your computer you can ensure that no harm befalls you and your pets

Are email disclaimers enforceable?

The Economist has a thought provoking article titled "Spare us the email yada-yada" with the subtitle "Automatic e-mail footers are not just annoying. They are legally useless". The article highlights some of the challenges facing email disclaimers and there are just no clear answers that I have come across. The central challenge is the following:

Many disclaimers are, in effect, seeking to impose a contractual obligation unilaterally, and thus are probably unenforceable.

When you send an email to someone and you have a disclaimer or link to terms and conditions, the recipient of the email may not be expecting your email or be familiar with your terms. That person may not be inclined to agree to your terms and conditions which you are effectively seeking to impose unilaterally. An email disclaimer is a form of contract with email recipients and contract law usually hinges on a "meeting of the minds" between the contracting parties. Unilaterally imposing terms and conditions is not a meeting of the minds and it is certainly not the result of some sort of negotiation.

A local blogger recently had a bad experience with a global fast food chain and tweeted his experience. The chain got in touch with him about the experience and unilaterally sought to prevent him from mentioning anything about his communications with the chain through, as I understand it, an email disclaimer. Why should the blogger be restrained from exercising his right to freedom of expression simply because the chain has a confidentiality requirement in its email disclaimer. This doesn't seem to be in line with the contractual principles which underpin these terms and conditions.

A counterargument which I have been thinking about is that the recipient is presented with a set of terms and conditions on the basis that her consumption of that email is subject to those terms and conditions. By reading the email and acting on it, the recipient is signifying, by her conduct, that she has read, understands and agrees to those terms and conditions. This is a similar principle that applies to website terms and conditions, parking terms and conditions and hotel checkins, to name a few parallel examples. The problem with this approach is that the recipient generally only becomes aware of these terms and conditions after having opened and read the email. References to email disclaimers are typically at the bottom of an email and where there are restrictions on confidential information disclosure, for example, the damage is probably already done by the time the recipient gets to the terms reference.

Another problem with email and a characteristic which distinguishes it from the examples I mentioned above is that emails are data messages sent from the originator to the recipient, often passing outside the originator's messaging system in the process. Unlike website terms and conditions and similar terms, originators can easily lose control of the disclaimer notice and are not guaranteed that it will be displayed prominently each time the message is displayed, or at all. While a website user can be bound by website terms and conditions just by visiting the website, the legal principle behind this starts to break down a little when it comes to email terms and conditions, at least the principle's application.

Absent clear authority on this (and I could have missed something), making use of email terms and conditions is a risk management exercise. If these terms and conditions are legally binding, despite their challenges, then companies would be irresponsible not to make sure that they not only make use of these terms and conditions but that these terms and conditions are complete and comprehensive. Can you afford to take the risk?

---

Image credit: Email with Mark Zuckerberg, CEO of Facebook by Robert Scoble, licensed CC BY 2.0

Look and Listen's ineffective Twitter terms and conditions

Look and Listen started following me on Twitter and because it is a brand I care about, I took a look at its Twitter page on the Web and followed it back. I noticed that its background image contains text regarding its terms and conditions as follows:

Visit us on Facebook for T & C's: Facebook.com/lookandlisten

This is Look and Listen's Twitter profile page on Twitter as viewed in a browser (the screenshot below is taken off my 24 inch screen. Viewing the Look and Listen page on my 13 inch MacBook reveals almost none of the important text at all - try this on your screen and see whether the link is even visible):

While this is certainly one way to publish terms and conditions, it is not a very effective way of making Twitter users aware of those terms and conditions for various reasons. Before I explore the reasons, it is important to understand the value of terms and conditions as they apply to social media platforms. I wrote a post about that titled "Disclaimers for social media" which may be worth reading before continuing with this post.

This method replies on users viewing the Twitter profile in a Web browser with sufficient screen resolution to accommodate the whole background image. People using older displays or lower screen resolutions may not see the text indicator for the terms on Facebook at all.

The next challenge is that users viewing Look and Listen's Twitter profile in other applications will not see the background image at all. Below are a couple examples:

iPhone Twitter app

Profile view in Seesmic Web

Desktop Twitter app

The background image with the link to Look and Listen's terms and conditions are not visible at all in this views (and it is safe to say that a significant number of people using Twitter don't use the Twitter page but rather apps with these or similar views) and those users viewing the Look and Listen profile are likely to be unaware that such terms exist. This means that they can not be said to have agreed to the terms or even be somehow bound by them in the absence of their knowledge of the terms' existence. So that approach only perhaps works with a fairly narrow sub-set of users who view the profile through a Web browser with sufficient screen resolution.

There are a couple solutions which are probably better solutions. The one solution I came across is a regular tweet containing a reference or link to terms and conditions. One company that does this is actually a law firm and my previous employer, Werksmans Attorneys. This is what their terms and conditions advisory looks like:

This approach has its benefits. It reminds people who are following the Twitter account about the existence and location of the applicable terms. Its limitation is that first time followers who follow from a profile view are not necessarily advised about the terms and conditions upfront and that could be problematic.

Another approach, which I prefer involves inserting a link into the bio section of a Twitter profile. A nice example of this is Jeremiah Owyang's Twitter profile which includes a link to terms that apply to his Twitter stream:

The advantage of this approach is that a prospective follower will see the Twitter bio and the link in the bio in most, if not all, Twitter apps. It is the first encounter with a Twitter user and more readily regarded as binding on new followers in much the same way that website terms and conditions are binding on website visitors. The disadvantage is that the link is not visible other than in a profile view. The best approach is probably a combination of the approach typified by the Werksmans reminders and the bio link approach.

Another reason why the background image approach isn't satisfactory is that the link is to a document located on Facebook. While referencing terms and conditions located on another page or website altogether is acceptable, Look and Listen simply refers to the Facebook Page which doesn't have any terms and conditions apparent on the Page at all. I only received a link to various terms and conditions when I queried this with Look and Listen on Twitter in a direct messaging conversation.

The effect of this is that no real terms and conditions are presented to Twitter followers and this means that Look and Listen lacks a legal framework optimised for its social media activities on Twitter. Instead, it will find itself subject to whatever the default legal positions may be on a case by case basis. In other words, Look and Listen has not done much to mitigate its risks.