I <3 Steve McConnell*
Coding Horror
programming and human factors
by Jeff Atwood

June 21, 2007

Does Anyone Actually Read Software EULAs?

If you've used a computer for any length of time, you've probably clicked through hundreds of End User License Agreement (EULA) dialogs. And if you're like me, you haven't read a single word of any of them.

Windows XP EULA text in German

Who can blame you? They're mind-numbing legalese. As a software developer, I understand that choosing a software license for my code is helpful to my fellow developers. But who, exactly, benefits from an end-user license agreement?

Firefox 2 EULA dialog

I'm an end user, and I don't recall anything good ever coming from clicking that "I accept" option. It's just another meaningless hoop I have to jump through before I can actually use the software. For all I know, the EULA could specify that the software is going to install a keylogger, steal all my passwords and financial information, send incriminating emails threatening the president, format my hard drive, and then sleep with my wife. How would I know? I blindly clicked that big, fat accept button, same as I always have.

Short of writing software to read the EULA and automatically flag such problems-- a conceptually brilliant solution to an intractable problem-- what's a poor "end user" to do?

The EFF points out a few common problems with EULA agreements you might want to watch out for:

  1. "Do not criticize this product publicly."

    Hidden within the terms of many EULAs are often serious demands asking consumers to sign away fundamental rights. Many agreements on database and middleware programs forbid the consumer from comparing his or her product with another and publicly criticizing the product. This obviously curtails free speech, and makes it more difficult for consumers to get accurate information about what they're buying by inhibiting professional watchdog groups like Consumer Reports from conducting independent reviews.

  2. "Using this product means you will be monitored."

    Many products come with EULAs with terms that force users to agree to automatic updates – usually by having the computer or networked device contact a third party without notifying the consumer, thus potentially compromising privacy and security.

  3. "Do not reverse-engineer this product."

    Some EULA terms harm people who want to customize their technology, as well as inventors who want to create new products that work with the technology they've bought. "Reverse-engineering," which is often forbidden in EULAs, is a term for taking a machine or piece of software apart in order to see how it works. This kind of tinkering is explicitly permitted by federal law – it is considered a "fair use" of a copyrighted item. Courts have held that the fair use provisions of the US Copyright Act allow for reverse-engineering of software when the purpose is to create a non-infringing interoperable program.

  4. "Do not use this product with other vendor's products."

    Vendors use EULAs to make consumers agree that they won't use products that evaluate the performance of the software they've bought, or that can be used to uninstall all or part of the program. Essentially, clicking "I Agree" to such a EULA means that you're not supposed to reconfigure your computer to touch or remove the software you've just installed. These kinds of EULA terms have become popular lately because many vendors support free versions of their products by packaging them with third-party programs that serve ads or gather information about consumer habits for marketing companies. If users uninstalled such ride-along programs at will, the vendors might lose revenue. For example, Claria (formerly Gator) is a company that delivers pop-up ads and pays to have its GAIN software bundled in free versions of popular file-sharing program Kazaa.

  5. "By signing this contract, you also agree to every change in future versions of it. Oh yes, and EULAs are subject to change without notice."

    Put simply, this means that when you install iTunes, you are not only agreeing to all the onerous terms in the box, but you are also agreeing to future terms that may appear in the iTunes Terms of Service months or years from now. These terms are subject to change without notice, and you don't even get a chance to click through this future "contract" and agree. Mere "continued use of the iTunes Music Store" constitutes your agreement to contractual terms that you may not be aware exist. These kinds of terms are ubiquitous in EULAs and in Terms of Service for countless products.

  6. "We are not responsible if this product messes up your computer."

    The disclaimer of liability for faulty software is perhaps the most important function of a EULA from the manufacturer's perspective. And it's bad news for the consumer. This term purports to supplant traditional consumer protection and products liability law. Clicking yes on EULAs containing this common clause means that the consumer cannot file class-action lawsuits against the vendor for faulty products, or for products that do not do all the things that the company advertised they would.

I've presented only the summary highlights; I highly recommend reading the rest of the EFF article for much more detail. Unfortunately, following any of the EFF's advice requires reading the EULA in minute detail, a time commitment that few are willing to make.

What I've pictured above are known as click-wrap licenses. Clicking through indicates assent to the license. But did you know that the physical act of opening some software can subject you to shrink-wrap license terms? Cory Doctorow calls shrinkwrap licenses an epidemic of lawsuits waiting to happen. I'm not sure about the lawsuit epidemic, but the jury is definitely still out on whether or not clickwrap and shrinkwrap EULAs are enforceable-- or even meaningful.

Clickwrap and shrinkwrap agreements all start with the phrase READ CAREFULLY, in caps. The phrase means, "IGNORE THIS." That's because the small print is unchangeable and outrageous.

Why read the "agreement" if you know that:

  1. No sane person would agree to its text, and
  2. Even if you disagree, no one will negotiate a better agreement with you?

Given the insanity of our current predicament, not reading the EULA could very well be the most rational course of action.

Posted by Jeff Atwood    View blog reactions

 

« The Windows Security Epidemic: Don't Run as an Administrator How To Advertise on Your Blog Without (Completely) Selling Out »

 

Comments

You forgot my favorite one:
"You will not work around any technical limitations of the software."

Geri Langlois on June 25, 2007 06:22 PM

Seems to me someone should set up a test case. Do the keylogger thing and wait around for the lawsuit... Seems like such lawsuits tend to lead only to *more* such crap, though, not less - but it might be worth a try.

Carl Manaster on June 25, 2007 06:23 PM

I don't know if there is a market for software that sleeps with your wife, but there is a potentially huge market for email chat bots that initiate cyber foreplay at 4pm using your account.

I think you're on to something...

engtech @ internet duct tape on June 25, 2007 06:28 PM

Because even if you don't read it, it may still be enforceable in court as a contract of adhesion. [Courts have ruled both ways]

contract of adhesion:
"A contract drafted by one party and offered on a take-it-or-leave-it basis or with little opportunity for the offeree to bargain or alter the provisions. Contracts of adhesion typically contain long boilerplate provisions in small type, written in language difficult for ordinary consumers to understand. Insurance policies are usually considered contracts of adhesion because they are drafted by the insurer and offered without the consumer being able to make material changes. As a result, courts generally rule in favor of an insured if there is an ambiguity in policy provisions."
- http://insurance.cch.com/Rupps/contract-of-adhesion.htm

wikipedia has more information:
http://en.wikipedia.org/wiki/Standard_form_contract

Admittedly being a contract of adhesion means that ambiguities are decided for the user... but still, given sufficent backing I would want to bargain for something better... Particularly about the "No Working around Technical limitations in the product" and "No reverse-engineering" clauses.

[I am not a laywer, the above understanding gleaned from /.]

Nick on June 25, 2007 06:35 PM

What if Webdesigners started including such outrageous EULA's in the comments of their html?

By downloading the rest of this Website, you are agreeing to have spyware installed on your computer without notice... any attempts to remove such spyware may result in the installation of more such spyware as well as (but not limited to) a keylogger, several hard disk eating viruses, and a few gB of that bloatware Dell PCs come preinstalled with.

Jim on June 25, 2007 06:43 PM

RE #5
I suppose that kudos are in order for Blizzard because of the way they handle the EULA for World of Warcraft. I haven't actually read it so I can't comment on what it says, but they at least give you the opportunity to change your mind if the license changes.

Every time that they release even a minor update to the software, you have to re-agree to both the software license and the online service terms of use agreement. Both have a clearly labeled "Last Modified" date at the top.

They even use the somewhat lame device of forcing you to scroll to the bottom of the document before you can click the agree button.

It doesn't do much for any of the other points. However, it is somewhat reassuring, provided that you read the whole thing once, save old versions, and run a diff on each new version before you agree to it.

kettch on June 25, 2007 06:46 PM

Having read lots of EULAs, my least-favorite provision is the one that prohibits the user from making more than one backup copy of the software. This is essentially a prohibition of normal, sane backup practices. Maybe it could be read as only prohibiting backing up the distribution CD, but it seems to prohibit full system backups -- or, at least, having more than one of them.

This is not at all a rare provision, either; it has been present in most of the EULAs I've read.

Norman Yarvin on June 25, 2007 07:00 PM

>This obviously curtails free speech

As an aside, in a strict, Constitutional kind of way, the idea of guaranteeing free speech is aimed at governments, not at private parties. The EULA is, at least in its designers' minds, a contract between parties, and it's hardly unheard of for contracts to include provisions for what can and can't be said about something -- that's what an NDA is, for example. I'm not sure that the idea of "free speech," as commonly understood, is even applicable in civil law, or perhaps in contract law. (I'm no lawyer.)

I mention this only because people occasionally get confused about constitutional rights, which, as noted, are designed to curb the US government, and people occasionally think that rights like "free speech" et al are absolute rights that always apply in all circumstances. Not so. Else such a contract would be unconstitutional, which it is not.

Ok, back to EULAs.

mike on June 25, 2007 07:19 PM

This came up just today as we showed our CEO the EULA added to our installer for a soon-to-be released product. She bemoaned the lame user experience, and the team agreed with her... but no one had a better idea. Our legal team suggests that it's the appropriate way to protect the company. What to do? Ideas?

Luke Melia on June 25, 2007 07:38 PM

>As an aside, in a strict, Constitutional kind of way, the idea of guaranteeing free speech is aimed at governments, not at private parties.

Thank you! I am becoming tired of people thinking that their Constitutional rights apply in private situations. Now if only the government would respect right #2....

Regardless, the EULA is one of the most annoying things I have ever encountered in the computing world. They are becoming more and more deceptive by using legal jargon, and they are beginning to extend their influence to limit parts of a system that are completely unrelated to the software. I easily expect the next version of Windows (if there is one) to limit the types of software you can install to "Microsoft-certified" software. That's why the GNU GPL is as great as it is, it does not disparage the end-user from using the software as he wants. s=Some day, open-source will be as ubiquitous as Microsoft software today.

Wotan on June 25, 2007 07:51 PM

We are not anymore software developers, programmers or artists. We have became now lawyers. Tons of license and patents I have to read and understand like a lawyer before I begin to code a simple GUI Button. Software became a contract not anymore a product. I'm very dissapointed where we are heading with the Software, Computer and IT industry.

jeff on June 25, 2007 08:10 PM

>That's why the GNU GPL is as great as it is, it does not disparage the end-user from using the software as he wants.

The GPL makes more restrictions than other open source licenses. BSD style licenses limit freedom far less than the GPL, especially GPLv3.

Of course, if you want the maximum amount of freedom you could always use the WTFPL (http://sam.zoy.org/wtfpl/).

kettch on June 25, 2007 08:22 PM

I hate EULA's! -- especially how they limit everything that you can do.

The fact that they say I can't do something angers me, even if I never planned to do it. Often, I don't consider what the license says I can or can't do when I do something questionable. I don't even bother with what the EULA says.

I do occasionally read EULA's, for instance, I did in fact read the EULA for Vista, which got to me where it prohibited working around limitations of the software.

James Cassell on June 25, 2007 08:23 PM

Part of the Second Life EULA got overturned recently because 1) the EULA was non-negotiated, 2) the terms were overly harsh, and 3) Second Life is the only service of its kind.

Tim McCormack on June 25, 2007 08:42 PM

The Google Toolbar EULA isn't much better:

http://pack.google.com/intl/en/integrated_eula.html?hl=en&ciint=ci_tb

I liked the EULA for earlier versions of the Google Toolbar, which said something like "Read this carefully: it's not the usual Yadda Yadda" w/r/t the opt-in anonymous tracking.

Jeff Atwood on June 25, 2007 08:50 PM

whew, thx Jeff for the rant. I thought I was the *ONLY* one who doesn't read those.

I love it especially when the default is on the "No". Wonder how many hours the lawyers charged for that decision on most softwares.

Thomas Han on June 25, 2007 08:54 PM

Back in the NT 4 days when I was still an MCSE, I tried to memorize it for the nerd humor of it. Beyond that, no, nobody reads these but you still have to have them to placate the lawyers.

Although they don't prevent you from moving forward on a site like the installation examples given here, German websites require an extra one on top of privacy settings and terms of use on other country specific pages:

http://welcome.hp.com/country/de/de/welcome.html

The "Impressum" link on the leftmost part of the footer is mandatory for all pages focused on people within Germany while only the privacy and terms links to the right of it are used elsewhere. Why? I have no idea. I just do what I'm told by the JD's.

Pete Johnson
HP.com Chief Architect
Personal Blog: http://nerdguru.net

Pete Johnson on June 25, 2007 09:06 PM

Does this make you think twice about using the VS.Net stuff? MS has some of the nastiest EULA's out there.

Grant Johnson on June 25, 2007 09:12 PM

I have never read an EULA; I have also not read this article.

housetier on June 25, 2007 09:40 PM

Then again. Why would you need a liability disclaimer for a piece of information?

Ever seen a cookbook with a liability disclaimer?

John Nilsson on June 25, 2007 09:44 PM

what are you talking about? the EULA is my favorite bathroom material, and when I'm done, I use it to clean up... I figure I'm doing the company a favor. After all, the crap that ends up on it, is probably easier to understand than was on it originally. But all seriousness aside. The EULA is just like a job contract, filled with meaningless jargon that no court (let me retract that, very few courts) would ever hold up.

"By agreeing to this document you commit your soul to SpyHackSoftWare, Inc. for an eternity of servitude"

that is oddly similar to the line of the contract i signed on for this head hunter

"By SIGNING this document you commit your soul to SpyHackSoftWare, LLC. for an eternity of servitude"

Jeremy on June 25, 2007 09:57 PM

By reading this paragraph you agree to an illegal contract which the courts will not uphold. This License will be laughed at by any judge who we can not buy.

David Ginger on June 25, 2007 10:07 PM

So you guys don't read EULAs? Too bad. You might inadvertently agree to let the software read anything from your HDD and send the information to the manufacturer. See Puzzle Pirates (http://www.puzzlepirates.com/).

Felix Pleşoianu on June 25, 2007 10:08 PM

Just modify the following text to your needs and publish it on you site or blog:

"By installing your software or any part of it, directly or indirectly, manually or by means of any automatic tool, on my computing device, you explicitly agree to be bound by the following terms:
...
If you find these terms unacceptable, you must cancel software installation and return device to it's state before installation."

:)

Iggi on June 25, 2007 10:32 PM

Ed Foster's Fair EULA:

Background:
http://www.windowssecrets.com/comp/070607#story1

Version 0.90.1 FEULA text:
http://www.gripe2ed.com/scoop/story/2005/3/25/02054/3216

--
"Fair" End User License Agreement, Version .90.1
1. We grant you one license to install and use this software on a single computer at a time. If you do not agree to the following terms of this license, please uninstall and remove all copies and return the product within 30 days of your purchase for a full refund.

2. You may install and use the software on another computer, but the software should not be in use on more than one computer at a time unless you purchase additional licenses. You may make back-up copies of the software for archival purposes. You may permanently transfer your license to use the software to another party who will be bound by this agreement, provided you do not retain any copies of the software.

3. The software is protected by the copyright laws of the U.S. and other countries, and we retain all intellectual property rights in the software. You may not separately publish, sell, market, distribute, lend, lease, rent, or sublicense the software. However, this license is not to be construed as prohibiting or limiting any fair use sanctioned by copyright law, such as permitted library and classroom usage or reverse engineering.

LIMITED WARRANTY

4. We warrant that the software will provide the features and functions generally described in the product specification on our website when you purchased it and in the product documentation. Media on which the Software is furnished, if any, will be free from defects in materials and workmanship.

5. We have taken all reasonable steps to keep the software free of viruses, spyware, "back door" entrances, or any other harmful code. We will not track or collect any information about you, your data, or your use of the software except as you specifically authorize. We will not intentionally deprive you of your ability to use any features of the software or access to your data.

6. We do not warrant that the software or your ability to use it will be uninterrupted or error-free. To the extent permitted by applicable law, we disclaim any implied warranty of merchantability or fitness for a particular purpose.

LIMITATIONS ON LIABILITY

7. Your exclusive remedy under the above limited warranty shall be, at our option, either a full refund of the purchase price or correction of the defective software or media. To the fullest extent permitted by applicable law, we disclaim all liability for indirect or consequential damages that arise under this license agreement. Nothing in this agreement limits our liability to you in the event of death or personal injury resulting from gross negligence, fraud, or knowing misrepresentation on our part.

GENERAL PROVISIONS

8. If any part of this agreement is found to be invalid or unenforceable, the remaining terms will stay in effect. This agreement does not prejudice the statutory rights of any party dealing as a consumer.

9. This agreement will be governed by the laws, including Article 2 of the Uniform Commercial Code, of the state in which you reside. If your state has enacted the Uniform Computer Information Transactions Act (UCITA) or substantially similar law, said statute shall not govern any aspect of this agreement and instead the law as it existed prior to such enactment shall govern.

10. This agreement does not supersede any express warranties we made to you. Any modification to this agreement must be agreed to in writing by both parties.
--

Jeff Atwood on June 25, 2007 11:15 PM

Software that contains ad-ware or even spyware often says it in the EULA --- probably because no one reads the things and the "contract" might offer the company some legal protection.

Likewise, some EULAs state that the product contains no ads etc. I've taken the habit of browsing the EULAs very quickly, to find these useful pieces of information. For instance, a EULA prevented me from installing a Tetris game recently :-)

I completely agree with the criticism, though. Most people just blindly click "Agree" and I can't blame them at all.

karen on June 25, 2007 11:57 PM

Funny that you have a picture of the german WinXP EULA, because in Germany, and probably in other European countries, too, EULAs are in general not legally binding. The idea is that you cannot sign any form of contract which you only see after you've bought the product. I wonder if EULAs are actually enforced anywhere outside of the US?

This may be an urban legend, but I also remeber a discussion about EULAs being not enforcable in the US if you had your underage kid klick the "OK" button. ;)

8jean on June 26, 2007 12:01 AM

@Nick (I'm also going on /. hearsay...)

Surely the difference between EULAs and contracts of adhesion is that you can only read the EULA _after_ you buy and pay for the software? It's not a take it or leave it basis, at least in the case of nonfree software.

Also, again from my great /. knowledge, there's apparently no limitation on use in traditional copyright law. So there's no reason why they can say you're not allowed to use the software you paid for if you click "No".

But of course, this doesn't mean one iota without actual knowledge of the law and case law :-)

Remco on June 26, 2007 12:09 AM

I HATE it when some idiot sees a box in the installer maker that he can paste into, and decides that everyone should have to click "I agree" to the GPL. Talk about missing the point — the GPL places *no restrictions* on the end user. Morons.

Fred Blasdel on June 26, 2007 12:41 AM

There is also the Reasonable Agreement:

http://reasonableagreement.org/

READ CAREFULLY. By [accepting this material|accepting this payment|accepting this business-card|viewing this t-shirt|reading this sticker] you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies (”BOGUS AGREEMENTS”) that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.

M on June 26, 2007 01:18 AM

Most Intl. EULAs are illegal in Spain, because Spain law is less permisive with mfr. products. For example, Windows and most Microsoft products EULAs have a lot of points that are not applicable in Spain.

For example Reverse Engineering. If product does not work as expected, and mfr. does not solve it, user can do whaterver he need to get working (incluiding reverse engineering, modifyng structure and so with no warranty lost).

Programs that monitor activities (wich main purpose is not monitor activities) are illegal, and are illegal limit a program to do a thing that can do -for example, if EULA says that XX compiler is not inteded to do compilers, but it can do, you can make a compiler with it (well, you cannot make a fried egg with a refrigerator).

And Company Creator/Importer/Seller have responsability of its programs.

FROG on June 26, 2007 01:25 AM

It's not just software EULAs, though, where this cover-every-eventuality legal behaviour is becoming pervasive. For example, the terms and conditions for UK mobile telephony operator Orange run to 18,500 words (about 35 printed pages using a simple copy-and-paste into Word). Analagous to the software EULA, unless I read everything, how can I know whether buried in there somewhere is the explicit right for Orange to record all my phone conversations for marketing purposes?

To buy anything from their website necessitates agreeing to a set of terms running to almost 64,000 words, or nearly 115 printed pages, presumably in addition to their terms of use. (See for yourself: http://shop.orange.co.uk/shop/terms?WT.svl=300). Even allowing that not all sections will be immediately relevant to a purchaser, it's hard to see that anybody has *ever* sat and read these terms right through, yet the user is obliged to click on "I agree" before making any purchases.

I once contacted Orange to query this state of affairs and they told me that there is no "cut down" version and nor could they tell me which parts were relevant to my purchase of a 50p ($1) SIM card. So I declined.

David A on June 26, 2007 01:27 AM

It all comes down to the legal situation that software is considered copyright material and hence the only person allowed to make copies is the author, and anyone they have approved - LICENSED - to make copies on their behalf. Software produced for an employer belongs to that employer.

Legally, if you do not agree to the license agreement, YOU ARE NOT PERMITTED TO MAKE COPIES. The EULA is the contract and terms under which you're permitted to make copies.

Installation counts as making a copy. Taking a backup of the installation counts as making a copy. Copying the source media counts as making a copy.

That said, it would be far better for the industry if the EULAs were drafted by marketing rather than by lawyers. Currently the EULA is not intelligible by the business, so it doesn't end up saying what they actually intend it to say, and it's not intelligible by the end-user, so they interpret the terms incorrectly. Witness all the furore over the Windows Vista EULA, where it was clear that the actual rights intended to be granted or denied by the product team weren't actually translated correctly into legalese, and the legalese confused the hell out of all the enthusiasts.

It's like you and me trying to have a conversation by using a foreign language, using an interpreter that doesn't understand the subject we're discussing.

Mike Dimmick on June 26, 2007 02:09 AM

In Australia, these things are unenforceable UNLESS you read it.

They can't override local consumer protection laws in any event.

So make sure you don't read it!

Frodo Barrister on June 26, 2007 02:31 AM

Whenever I get a EULA I say out loud, "I do not agree with this EULA and if you, the software vendor, do not agree that I have a right to use your software without agreeing to the EULA then you may come into my office/home and remove the software from my hands, you have 5 seconds..."

This statement makes as much sense, and is as enforceable, as a EULA so they cancel each other out.

Fighting stupidity with stupidity since 1901.

Kai Tain on June 26, 2007 03:02 AM

EULAs.. "sigh" :(

Muammar on June 26, 2007 03:59 AM

reminds me of a software cd i have which says and i quote "Breaking this seal indicates your acceptance of the license agreement contained in this product", the license agreement is on the cd! so you can't read it without agreeing to it.

Sam on June 26, 2007 04:10 AM

I agree that nobody reads it, but we (as software developers) need to put it in every setup. Or there is other way to do this thing?

edddy on June 26, 2007 04:23 AM

Get rid of the EULA. Start now.
A more viable solution (from a technical, not a lawyers POV) would be: The EULA has to show a summary of the core points that fits into one text box w/o scrollbars or other means of wrapping, in at least a 12 pt font, and understandable by what has to be rated as an average customer. If we can (strive to) design software that can be used by people with a minimum of (computer) knowledge, why shouldn't lawyers do the same for legalese?
But this won't happen as long as lawyers (even in-house in a lot of companies) are allowed to take legal as well as real entities on the leash and make their own set of rules to be forced upon everyone. It's a distributed, subtle abuse of power that has to stop or collapse somewhen, but for that it probably has to get much worse yet... What? Yes, I'm a pessimist on that point :-(

Murphy on June 26, 2007 04:25 AM

When I feel like I need to break a EULA and make that breach public in some form, I generally replace the EULA with my revised version. In installers, I replace the current text. Thier program, acting as thier agent, agrees to the revisions I propose. Web services, just edit the HTML.

Blank on June 26, 2007 04:31 AM

They should simply say...

This software is not fit for any purpose, application or otherwise deployment. Use at your own risk...

Rights? You have no rights.

Well, that's what the lawyers want...

rabid wolverine on June 26, 2007 04:35 AM

A related annoyance is that several FOSS installers now require you to accept the GPL before they will continue the installation. I doubt there is any legal point in doing so, and it seems to contradict "freedom zero" -- the right to use the sofware for whatever you want.

It seems the makers (or at least packagers) are trying to imitate the "real" software vendors -- look at us, we've got real legal bullshit now too! -- when it should be the other way around.

Walter on June 26, 2007 04:57 AM

I have a vague recollection of a company that put a 'prize' in their EULA, to the effect that the first person to email a certain phrase to a certain address would win $50 (or something along those lines).

The prize went unclaimed for quite a while. Anyone else remember this, or the correct details?

Mack on June 26, 2007 05:02 AM

Most EULAs say "if you do not agree with the EULA, please quit now, and return the software for a full refund", however, most stores, thanks to piracy, won't take opened software, so you're screwed anyway.

dnm on June 26, 2007 05:27 AM

The iTunes one is freakin' ridiculous. 'You agree to anything we say, and anything we may say in the future' (paraphrasing). Anyone can see that CAN'T be held up in any honest court of law.

Maybe Mr. Stallman's got more of a point than people give him credit for...

Bernard on June 26, 2007 05:37 AM

I'm not associated with it, but I've used Eulalyzer to at least be aware of horrible EULAs.
http://www.javacoolsoftware.com/eulalyzer.html

Rob on June 26, 2007 06:08 AM

"
You forgot my favorite one:
"You will not work around any technical limitations of the software."
"


Ah yes...that reminds me of the whole TestDriven.NET debacle.

Joe Beam on June 26, 2007 06:08 AM

Wow, the Windows XP EULA is now written in German? Now I'll really never read it! :)

Matt on June 26, 2007 06:20 AM

I just saw Peter Norvig "Theorizing from Data" talk http://www.youtube.com/watch?v=nU8DcBF-qo4 and someone asked if Google would consider a service where small site operators could submit a comment posting and Google would reply with some "spamminess" rating.

I wonder if it's possible to compute a "how much freedom am I giving up by agreeing to this EULA" score? Maybe it's possible to correlate EULA's with legal or other hostile action against users.

For example, whatever it says on a CD or DVD these days would give a score of 1.0, and software you write yourself would be 0.0.

Mignon on June 26, 2007 07:02 AM

I guess none of you has read your credit card agreement.

Daniel on June 26, 2007 07:24 AM

So computers do vision and voice recognition...

It's about time for computers to read a text (such as a EULAs) and tell us ONLY what is important about it!

Jonas on June 26, 2007 07:28 AM

There is a legend that someone wrote in EULA that the first born of the user has to be sacrificied to crocodile God for a small freeware just to see if anyone reads it. Nobody complained.

m on June 26, 2007 07:34 AM

Pete Johnson wrote:
"The "Impressum" link on the leftmost part of the footer is mandatory for all pages focused on people within Germany...
Why? I have no idea"

You get the idea, when you encounter online-shops, which have no address or e-mail at all - often enough you encounter that not until something with your order goes wrong.
A shop without an postal address and other mandatory declarations could be closed very easy under the german top-level-domain ".de", because it's simply illegal.

For consumers, this is a good act. I claim that there is less e-crime in shops under the german-top-level-domain compared to many other toplevel-domains.

Practically, you will not find a shop in german without correct information in the impressum, at least not very long.

toettoe on June 26, 2007 07:56 AM

It might be interesting to consider that an admin or a user accepting a EULA for a piece of enterprise software could be entering their company into a legally binding agreement. Companies frown on employees taking such actions. Let's get the lawyers involved next time we need to install something!

Chris on June 26, 2007 07:56 AM

"Run it by legal" isn't fun for you, or for legal...

So, we all agree that we have an uninteresting, unreadable piece of text that is unbinding and unenforceable.

Is the answer to just leave it off? Hide it in the readme.txt file? Make the installer verify your identity using two pieces of ID and your Single Sign On account? Take a picture of your face with your webcam during install to prove it was you that cliked OK?

It's all just FUD (Fear, Uncertainty and Doubt) propagated by the unreasonable tort business. Ignore it.

Chubber on June 26, 2007 09:01 AM

My favorite from the Java EULA:

You acknowledge that Licensed Software is not designed or intended for use in the design, construction, operation or maintenance of any nuclear facility.

Jom on June 26, 2007 09:03 AM

"When Doug Heckman was installing a PC Pitstop program, he actually read the EULA. In it, he found a clause stating that he could get financial compensation if he e-mailed PC Pitstop. The result: a $1,000 check, and proof that people don't read EULAs (3,000 people before him didn't notice it). The goal of this was to prove that one should read all EULAs, so that one can see if an app is spyware if it is buried in the EULA."

http://www.pcpitstop.com/spycheck/eula.asp

Jeff Atwood on June 26, 2007 09:13 AM

I have a modest proposal: the EULA-mangling virus, which randomly changes the terms of any EULA agreements it detects.
http://ivymike.blogspot.com/2005/07/eula-virus.html

IvyMike on June 26, 2007 09:46 AM

Never read EULAs either, sometimes I skim through them though.

Samuel Saint-Pettersen on June 26, 2007 09:46 AM

I just found this interesting, that it happened to hit reddit today.

http://www.bannedbygaussian.org/

it's a case of taking the EULA seriously, and bannign

capiCrimm on June 26, 2007 09:55 AM

You know, as someone who writes commercial software, I gotta say: every word of the license agreement is important and you should read it, understand it, and agree to it and if you don't, you really shouldn't use the software. My licenses are very clear, written in legally-binding but understandable English, and they give you specific rights, deny you certain rights, and absolve various parties of liability. You need to know what those are, because they are not the same for every software. With the exception of number 5, all those things are reasonable, and "any sane person" should know that.

I know what you're saying here, but users can't be allowed to just do whatever they want. I don't put any code to actively prevent someone from decompiling it, for example, but I make it clear in the license agreement, that if they do that in an attempt to discover trade secrets or defeat security, then they are committing a crime. We can show the monetary cost of such actions and we have every right to try to prevent people from doing it. We need to make sure they agree not to hack it, or it constitutes de facto permission.

The "tort business" is not unreasonable. It is a scary thing which can bring a company to its knees if improperly managed. We're not doing anything intentionally malicious with our software, and we should be protected from stupid user actions. You talk about that all the time on this blog, and you know how prevalent it is. I don't want to be sued for anything my software does, and I am happy to work with people if it causes a problem. Do not disregard the EULAs... they are legally binding, and I don't know why you think it's appropriate to ignore them. You are entering into a legal agreement which has been enforced by the courts... it's a good idea to know what that agreement is. I don't agree that users should have the rights you think they should.

Managing my public image, monitoring the use of the software, protecting my trade secrets and protecting my company from liabilities resulting from misuse is a responsibility of the company, and if I didn't do it, I would be sentencing the operation to death. And in reality, the license itself doesn't prevent you from doing any of that. You are free to hack all you want, but if you do, you are in violation of the agreement, and we don't have to help you. Hack at your own risk... and one of those risks is that you may put yourself in serious legal trouble if your hacking hurts my company in any way. We have these ideas for other products, so why not software? If you crush your thumb with a hammer, you misused it and you can't sue the hammer maker for damages, it's your fault... and that is what license agreements are about.

Jasmine on June 26, 2007 10:29 AM

<i>he could get financial compensation if he e-mailed PC Pitstop</i>

Right-o, that's what I was thinking of. Very cool for Doug Heckman.

Mack on June 26, 2007 11:05 AM

With every EULA I see, I'm more happy that they're not legally binding in Germany. So there's no reason whatsoever for me to read them. :-)

Moritz on June 26, 2007 11:51 AM

"My licenses are very clear, written in legally-binding but understandable English, and they give you specific rights, deny you certain rights, and absolve various parties of liability."
Legally binding in which countries? I've yet to see a licence that can claim to be universally legally binding in any country, the very attempt to legally bind someone under another countries legal system can be ilegal in another country. An agreement made via an EULA in Ireland with a French citizen (for example) is unlikely to enforcable by the Brazillain software company.

anon on June 26, 2007 12:06 PM

Was there a EULA when I paypaled you money for coding horror stickers that said "notice: I will not actually send them to you"? I'm still waiting...

:(

Billkamm on June 26, 2007 12:39 PM

To Jasmine: I don't know where you're getting your information from (I can probably guess), but the parts of your post that aren't incorrect are horribly misleading.

Courts have upheld EULAs in the past, but only in one area: copyright violations. The main high-profile case was one in which the user took the database from some consumer product and started reselling it online, when the original product was explicitly labeled "not for commercial use". That was a flagrant copyright violation with a direct analog in regular retail, and they didn't even really need the EULA for it.

EULAs *cannot* override consumer protection laws or fair use - even a signed contract will generally be struck down in court if the contract is found to violate state or federal law. Copyright law is intrinsic anyway, and if you're concerned about liability, just put in the "no warranty" clause and be done with it. The stuff about criticism, monitoring, reverse-engineering, etc.? Good luck getting that enforced.

Practically, clickwrap licenses are on par with e-mail disclaimers in terms of enforceability (in other words, useless).

If you believe this to be wrong, please feel free to cite one or two CA/SC cases where an EULA has been upheld without a corresponding copyright violation.

Aaron G on June 26, 2007 12:54 PM

Aaron: breaking the terms of the EULA - any of them - is copyright infringement. Without the EULA, you do not have a license to make copies. Without the license, you are infringing when you make any copy, and that includes installing on your own system. Fair use applies to making small quotes from a work for the purpose of exposition, and in practice cannot apply to software.

Certainly there are terms that conflict with rights given in law - reverse engineering is legal in the US and in Europe, for the purposes of compatibility - but I believe a judge would consider that the existence of such terms did not invalidate the contract entirely, merely strike down the invalid terms.

As for what's legally binding language, it's whatever a judge will accept that your intent was. There's no real need for lawyers to torture the language, because it's simply not possible to write English that is incapable of being misconstrued. Heck, we can't manage it with our carefully-constructed programming languages (otherwise there would be no bugs).

Copyright is supposedly enforceable between people and organisations in any two countries that have signed the WIPO Copyright Treaty. So yes, since France, Ireland and Brazil are all signatories (France and Ireland through the European Union), anon's example should indeed be enforceable.

Mike Dimmick on June 26, 2007 01:10 PM

"So you guys don't read EULAs? Too bad. You might inadvertently agree to let the software read anything from your HDD and send the information to the manufacturer. See Puzzle Pirates (http://www.puzzlepirates.com/)."

I looked at their EULA and still can't see where it says that?

Can you point it out to me please :)

Jim.

Jim on June 26, 2007 01:17 PM

I have always admired Borland's "No-nonsense license agreement": "You can use this software like a book..."

Davide on June 26, 2007 02:39 PM

I'm not an expert but I have just completed first year law up here in Canada and I did sleep at a Holiday Inn Express last night (OK, the Holiday Inn bit is a lie). The nature of a EULA is a contract between a party in a strong bargaining position (the vendor) and one in a weaker position (the user). As such, courts generally do not uphold such agreements where the contract is an abuse of power by the stronger party - hence the earlier statements made by some that EULAs do not override consumer protection laws. However, where such agreements are reasonable, the courts will uphold them as it would be inefficient to force corporations to individually negotitate such "standard form contracts" with each potential customer.

Courts have upheld EULA agreements in Canadian courts, notably in Kanitz v. Rogers Cable Inc. (http://www.dww.com/decisions/kanitz_v_rogers_cable_inc.pdf). However, that was a bit of a special case in that the Defendant, Rogers Cable, modified the EULA that had been agreed to by the Plaintiffs as part of their contract with the prior cable provider (Rogers and Shaw swapped huge regions of Canada at one point, Shaw taking over Rogers operations in B.C. for example, and Rogers taking over Shaw operations in Ontario where this case arose). Rogers added an arbitration clause to the contract for dispute handling and _notified_ their customers of it, admittedly in a somewhat non-obvious manner, and further indicated that continued use of their service meant the customers agreed to the altered terms of the contract. In other words, had Rogers not made an effort to notify customers of this change, it seems unlikely the courts would have found in their favour. However, as they did place a notification on the home page which all service users were asked to check periodically, the courts found that notice was given.

What is perhaps, to me, most interesting about the Kanitz case is that it illustrates that the courts, with respect to matters of software, often make decisions that don't really make that much sense to those of us with software training. Software is a complex business with complex issues that take many people their whole lives to understand (and we still often fail to grok these issues). When you take such a complex issue before a judge who likely does not have a software background, the judge will make decisions based upon what (s)he understands and that may or may not mesh well with the software realities. It will take time for the courts to iron things out - until then, expect erratic rulings regarding EULAs with the courts sometimes coming down in favour of the vendors and sometimes in favour of the clients. These decisions will be further complicated by the international nature of the software industry and the "conflict of laws" that occurs when parties to a dispute operate in different countries or make agreements in different countries.

Consider the landmark English Court of Appeal case in Parker v. South Eastern Railway Co. (1877). Here the plaintiff checked a bag in excess of 10 Pounds Sterling (English money) which was lost. A disclaimer on the ticket stub indicated the railway would not be responsible for the loss of any bags over that amount. The judge's ruling, I believe, sets the tone for these types of agreements with "The plaintiff was certainly under no obligation to read the ticket, but was entitled to leave it unread if he pleased ... the real question, namely, whether the railway company did what was reasonably sufficient to give the plaintiff notice of the condition".

A more current case, Interfoto Picture Library Ltd. v. Stiletto Visual Programmes Ltd. (again, English Court of Appeal) contains the statement "The defendants [clients] are not to be relieved of that liablility because they did not read the condition, although doubtless they did not; but in my judgment they are to be relieved because the plaintiffs did not do what was necessary to draw this unreasonable and extortionate clause fairly to their attention".

At least in England, Canada and other commonwealth nations, it would seem that EULA agreements are, like any contract, subject to assessments of what is reasonable and fair. Those in power cannot abuse that power and those in power must make sure that they bring to the attention of the other party particularly onerous clauses. The question that, to my knowledge, has not been properly addressed although is alluded to in Kanitz is whether a simple click on an accept button for an entire EULA is sufficient evidence that the vendor brought onerous conditions to the clients' attention. I would suggest that it is not sufficient but I am not the court and have no idea how a court will eventually rule, if one has not already.

I am sorry to U.S. readers that I have little information on U.S. cases but, as the U.S. courts pay little attention and give little deference to foreign courts, it is not unsurprising that foreign courts give little deference and pay little attention to the decisions in U.S. courts.

DISCLAIMER; This information is provided merely as background information and is not intended as legal advice in any way, shape or form. The author does not claim it to be either an accurate or even adequate coverage of the issues at hand.

Tim Dudra on June 26, 2007 03:26 PM

I have my own version of the software EULA:

http://www.ransom-note-typography.com/index.php/weblog/85/

Feel free to copy and use it, my software dev, friends!

jon deal on June 26, 2007 03:57 PM

The (old) Borland "No-Nonsense License" is interesting:

http://info.borland.com/appserver/aps45/appserver45_license.pdf
http://luciernaga.it.uc3m.es/software/windows/Desarrollo/Delphi6/INSTALL/program%20files/Borland/Delphi6/license.txt

--
b. This Software is owned by Borland or its suppliers and
is protected by copyright law, international copyright
treaties, as well as other proprietary notices. Therefore,
you must treat this Software like any other copyrighted
material (e.g., a book) and you agree that the total number
of copies of the Software used by you may not exceed the
number of Licensed Copies paid for by you, except that you
may either make one copy of the Software solely for backup
or archival purposes or transfer the Software to a single
hard disk provided you keep the original solely for backup
or archival purposes.
--

Jeff Atwood on June 26, 2007 04:39 PM

I don't even think companies are really paying attention to their EULAs. I was struck by the fact that a EULA I read recently says that you can install it on an unlimited number of computers for your own use, but make only one backup copy (these statements are very, very far apart in the EULA).

And it was software that you can download without charge with registration anyway - what's the point?

Nic "RedWord" Smith on June 26, 2007 07:16 PM

In the same topic, there is a service called GooDiff : http://www.goodiff.org/ targeting EULA for web services.

The service monitors policies or EULA from various web company.

karl on June 26, 2007 11:22 PM

Why do FOSS developers make you click the GPL? It's not about how you use their software. The GPL doesn't limit that.

Don't forget, end-users of GPL'd software can be distributors, too. The point, I would assume, is to make sure that users (who care) are aware that they can freely obtain and redistribute the source of this software. Usually you can spread the provided binaries around for free, as long as you make the source available as well.

Steve on June 27, 2007 10:14 AM

A first look at the proposed "Principles of the Law of Software Contracts":

http://www.satisfice.com/kaner/?p=19

Jeff Atwood on June 27, 2007 12:09 PM

Problems with EULA's:
Not allowed to increase the size of the eula window.
Not allowed to increase the size of the eula text.
Not allowed to save eula to a file so another progam - like a word processor or browser - can do the above two steps to ease reading.
Also, I suggest they take lessons from a school teacher or sdvertising designer in organizing for readablity. I learned that when I was 13 years old from a science teacher when preparing for a competion.
Yes, I skim the eula and sometimes refuse.

chris weber on June 27, 2007 04:16 PM

I put the following EULA in some VB code installs and EVERYONE clicked through it.

doGteN End User License Agreement (EULA)

I - The user understands, acknowledges, and gives express permission for the application and/or associated components to collect personal information, including, but not limited to, name, demographic data, interests, profession, education, marital status, sex, age, income, computer usage, address book, chats, site visitation, downloads, computer contents, and any other information doGteN decides to collect at his sole discretion.

II - User hereby understand, acknowledges, and gives express permission for application and/or associated components to disable or delete applications and/or files deemed unfriendly or harmful to doGteN or any of his associates at doGteN's sole discretion without notice to the user, and may auto-reinstall applications and/or any associated components.

III - User hereby understands, acknowledges, and gives express permission for doGteN or any of his associates at doGteN's sole discretion without notice to the user to remotely control applications and/or associated components.

IV - User hereby understands, acknowledges, and gives express permission for doGteN or any of his associates at doGteN's sole discretion without notice to the user to create, transmit, or delete any data doGteN deems necessary.

V - User hereby understands, acknowledges, and gives express disclaimer of liability and damages to doGteN.

VI - Future Licenses: By using this software, you agree to not only this license, but to any future revisions to this license. You also agree to any future licenses for other products from doGteN, whether or not you actually purchase them, and to any revisions to those licenses, including terms that require you to agree to other licenses, and revisions to those licenses. You agree that if you attempt to not agree to these licenses, then you automatically agree to yet another license, and it's a lot harsher than this license, so just watch yourself.

doGteN on June 27, 2007 04:44 PM

Here's the license I put on some programs I wrote in 199?:

END USER LICENSE AGREEMENT

I. INTRODUCTION: By agreeing to this license, either by clicking the "I accept" button, or through electronic or standard mail, or by loading this text into active computer memory, you agree to all the terms of this agreement, all the terms of future revisions of this agreement, all of the other agreements which I write, any agreements I agree to, any agreements I do not agree to, any agreements which I think of writing, and any agreements present in alternate quantum realities.

II. RESTRICTIONS: You may not copy, reverse-engineer, decompile, execute, install, look at, think of installing, download, or breathe in the presence of this software. Such actions would be deemed copyright infringement, and dealt with under the law of the country of origin of this license.

III. AGREEMENT: By agreeing to this license, you must worship me, the author, in pagan style. This includes firstborn sacrifices, idol worship (Hey, you Americans do that already) and self-punishment. Sacrifices consisting of daughters need not be fully sacrificed, you need only send them to me. Pizza would be cool, too. And beer. Don't forget the beer. A case of Sam Adams Oktoberfest is plenty for a day or so.

IV. USER PARTICIPATION: User participation, in effect at the agreement to this license, will consist of: bowing before the author; holding the author's place in line at the @$%&ing ticket booth, carrying the author's books, and cleaning the author's dormitory.

V. CLOSING: So Long, and Thanks for All the Fish.

Wotan on June 28, 2007 05:28 AM

I've always want to SEND A EULA back at 'em:

"By my using your software, you agree to provide me, the End User, software that "approximates" the stated behavior in the marketing material on the cover of/website for your product. Failing to present such functionality by misrepresenting said product will automatically cause an invoice for 10x the purchase price to be generated and sent directly to your CEO's home address..."

Bill Holtsnider on June 28, 2007 08:21 AM

Jim did you skip this part by any chance?

"10. Privacy. You understand that you have no expectation of privacy with respect to your use of the Site, Services or Games, and that all communications made by or received from you may be monitored, preserved and disclosed by Three Rings representatives. You hereby consent to the extraction of hardware system profile data and any data related to operation of the software from any computer that logs on to the Site, Services or Games using your account... ...These Terms are also subject to Three Rings' general Privacy Policy, which is incorporated by this reference as if set out in full."

Which also states that whatever is not included here, we'll use too as if it were.

also: Any data related to operation of the software from any computer that logs on to the Site... If you use your pda to connect to it, it may be monitored too, creepy or what?

Jessy L on June 28, 2007 09:37 PM

I own a car, and I drive it around a fair bit. I keep driving past these signs that say things like "Welcome to North Vancouver" or "Now Entering Alberta". And, do you know, NOT ONE of these signs says:

READ THIS CAREFULLY!
By Traveling past this politically defined point on, above, or below the surface of the planet on which this sign is posted, you agree to abide by all laws, regulations, situations of liability and so forth, all of which are subject to change at any time, that any arbitrary political or bureaucratic entity may choose to enforce. Full copies of all such regulations are available for perusal at their place of storage, which may not be clearly indicated as such from the exterior, nor may be available in any language understood by you. Full knowledge and understanding of all such regulations is required of all residents and visitors at all times.

AND YET, every single place I go it is assumed that I agree to these terms, like them or not. Hmmm...

Chris Moorhouse on June 28, 2007 10:45 PM

You guys need to read about UCITA. Google it, but you won't like what you read.

Daniel Zee on June 29, 2007 01:09 PM

I actually never read an EULA and I am quite stunned of what they can put in there.

Why don't they just put another : "By using this software you agree to sell your soul to the devil. Thanks for understanding."

CrazyLeaf on June 29, 2007 02:18 PM

I don't have the problem, I don't have any of that; in fact all my software on all my machines are free. Download from the software companies that produced them. There not hot, there not stolen, just free the way God intended it to be.

In fact, I don't get any spyware or keyloggers since all this software automaticly downloaded to my machine from a common source complete with the source code, yep, thats right you can read it and see it all for your self, and if you want you can add to it and try to better it. If you better it, people with there machines set up to to download new testing software will check it out and inform you of the related bugs.

If your software has viruses, it simply is not added to these downloads sites call repositories.

Points:
* Free Software
* Clean
* Auto-update
* Search Manager finds-uncompresses-installs-configures software

http://www.debiantutorials.org/content/view/156/208/

No more Balls and Chains

Thank you for your time reading this, the only downside that I can think of; is there is a month learning curve.

But if we all started doing this the Major software companies would start to realize that they are just as fragile as the Music industries. If they get to greedy, we might even get smart and make the jump too http://www.debian.org/

Later,

Greyspace

Greyspace on June 30, 2007 10:19 AM

Do we (users) have to agree to a license just to run the installer program? If not, then what is to stop us modifying the installer to not require reading of the EULA to install the program?

anon on July 1, 2007 04:28 AM

the EULA is a boring part of installing programs, but it is necesary to read it, because many times there is crucial info in there

justus on July 2, 2007 02:06 AM

I actually never read an EULA and I am quite stunned of what they can put in there.

gadgotra on July 2, 2007 06:05 AM

http://www.copyright.gov/title17/92chap1.html#117

US Code Title 17, section 117 states that it is specifically NOT a copyright violation to either make copies incidental to using the software (loading it into memory) or make backup copies.

If you buy a copy of software, you OWN that copy. The copyright holder has some enumerated exclusive rights, but anything else, you can do. And you do buy it. You pay sales tax and everything.

You don't need a license to run a copy of the software you bought. Therefore you don't need to agree to the EULA, as it give you no additional rights that you didn't gain by buying the software. Not agreeing to or violating the EULA terminates it, but does not cancel your ownership of your copy of the software.

I'm not a lawyer, but I can read. It looks like in the USA, EULAs are unenforceable.

Anonymous Coward on July 10, 2007 09:04 PM

Women's Choir Sings Eerie Version of Sony/BMG EULA

http://blog.wired.com/music/2007/07/mp3-womens-chor.html

Jeff Atwood on July 25, 2007 11:10 AM

> This EULA is just a little more to the point than most, saying in two words what many EULAs take several screens to say.

http://www.boingboing.net/2007/08/08/twoword_license_agre.html

Jeff Atwood on August 8, 2007 11:35 PM







(hear it spoken)


(no HTML)




Content (c) 2008 Jeff Atwood. Logo image used with permission of the author. (c) 1993 Steven C. McConnell. All Rights Reserved.