Dropbox updated its terms of service last week and a firestorm of controversy ensued.
Many thought Dropbox was setting itself up to take license rights in user content that went beyond what a storage service should need — as though Dropbox might be planning to monetize user content in some fashion.
Dropbox responded by changing its TOS to “clarify” that the license it requires from users is only intended to permit Dropbox to provide the Dropbox service. Others remain skeptical.
At my request, four tech and licensing lawyers I respect offered their views. If there’s a consensus view, it’s that there’s still a gap between what Dropbox says it intends, and the breadth or ambiguity of the actual language of the Dropbox TOS.
Their respective readings follow below. The headers are my attempt at summarizing a key point of each.
Michael Schneider: limit the scope of the license to what the user requests Dropbox do.
I asked the mobile app developer and IP lawyer Michael Schneider the following question: Is Dropbox asking for a license where a simple use right would do? He told me the distinction I was drawing was not the important one:
“To me, whether you call the rights they are asking for a license or a right to use is not material. What matters is the scope of the license or right to use.
“They ask for the right to use users’ files to ‘provide the Service,’ but the ‘Service’ is defined very broadly as the ‘Dropbox websites and services.’ I would feel much more comfortable as a user if the license were limited to use of the files to ‘provide the user with the goods and services the user requests from Dropbox.’ At least that formulation makes it clear that your files will not be used in ways you haven’t requested.”
Venkat Balasubramani: the intentions expressed in the Dropbox blogpost are relevant, but the license language could have been tied back to a user’s settings.
Internet lawyer and blogger extraordinaire Venkat Balasubramani skipped my question and reframed the issue, the better to make room for his measure of the tension between Dropbox intentions and the lack of contractual clarity:
“My read of the situation is that Dropbox included language in their rev that granted them permission to propagate your content–it looked like a protective measure that prevented them from getting sued by someone who claimed that Dropbox did not have the technical right to distribute or publish content that someone uploaded to their Dropbox account. Their initial rev was fairly clunky and created a firestorm, and in response they posted two blog posts, and made further clarifications to their terms.
“Although it’s easy to second-guess someone else’s drafting, their revisions still leave things unclear. I would have explicitly tied the license back to their user settings:
“You grant us a license to reproduce, distribute, display (etc.) your content as necessary to reproduce, display, or distribute it in accordance with your settings for the particular piece of content. This license shall be limited by your account settings. For example, if you upload content and set the content to ‘public,’ this means that you authorize us to reproduce, display, and distribute such content to the general public. On the other hand, if you share content with a limited group of people, our license shall be similarly limited to reproducing, displaying, and distributing this content solely to this group of individuals. If you set your settings for a particular item of content to ‘private,’ then this license does not allow us to reproduce, display, or distribute this content to any third party
“I think this is what Dropbox intended to say, but for whatever reason, their revised language states that users grant them a license ‘to enable [them] to administer … and operate the Services.’ By not tying the license to the user’s settings, the language creates some doubt. ‘Administering’ and ‘operating’ the content could mean anything.
“In this era of rights grabs by companies such as twitpic (and even third parties) users were somewhat justified in their reaction, but my instinct is that Dropbox was not aiming for a power-grab with these revisions. This is definitely the tenor of their blog posts (which, interestingly, will probably be cited in any litigation over the scope of this license). As a general matter, I’m pretty hesitant about sharing ‘valuable’ or private/confidential materials through Dropbox and other similar services. Their revisions don’t change my practices a whole lot but give me further pause. That said, I am not about to terminate my account in response to this. Terminating your account over this feels like an over-reaction to me.”
Jeremy Freeland: the Dropbox TOS are too sloppy for business purposes; next contestant!
Readers of this blog are used to seeing comments by IP licensing lawyer Jeremy Freeland that exceed the merits of the post on which he comments (ahem). And so he did again on an earlier post here on the Dropbox matter. The following is a re-posting of that prior comment from Jeremy:
“Well, I had spent the weekend thinking I might give Dropbox a try, without having read these terms. Now, not so sure. Definitely not for client information, nor for sensitive information. The challenge for these companies is how to write technical licensing language in a folksy manner. My view is that given the increasing emphasis on privacy, and the growing sensitivity to use of UGC, folksy is looking passe. What’s needed is plain English, with a license grant that is both sufficient to allow the business to conduct its operations, but also defensible to the user base. If the business is trying to keep its options open to pursue an as yet unannounced business model, then the license grant is absolutely the wrong place to make this announcement.
“Here are some of the issues I think need to be addressed:
“1. How do the rights dovetail with the privacy policy and the privacy settings settings that the user has selected for their content? There is a reference to the privacy policy in the same section of the TOS, but the only realistic restrictions on Dropbox in the Privacy Policy are with respect to ‘Personal Information.’ Not all of a user’s content may qualify as Personal Information. My preference would be to see an express statement within the license grant that content will only be displayed in accordance with the display settings the user has selected. If the user has opted to encrypt their information, then I’d like to know in what circumstances the content could be decrypted by persons other than the user (e.g., if the company is performing ‘technical operations.’)
“2. What is the term for which the license applies? Is it just for the period in which the user has content on the Dropbox site, does it also need to extend for a transition period once the content is removed or the user terminates their account, and how will backup copies be treated?
“3. What’s missing is informative – why aren’t we seeing that the license grant is ‘non-transferable’? (My guess is that DB wants the flexibility to get bought, but as a user, I’d like to know that (a) that’s all, and (b) what my exit options are if I don’t like the purchaser, e.g., for those of you following UK news, News Corporation is not flavor of the month right now when it comes to observing privacy rights.)
“4. ‘Those we work with to provide the Services’ – this is really loose. What I’d like to see it say is something like ‘and our service providers, to the extent they are providing services to DB to operate the Services.’ As it currently stands, this language could extend to peripheral services activities, and conceivably to marketing partners.
“5. ‘Sub-licenseable’ – WHAT? Since the grant already includes ‘service providers’ who is this aimed at? This is a big issue that needs more explanation.
“6. The ‘solely to enable’ language – I’d prefer to see this in the body of the license, e.g., [you] grant [me] a non-exclusive license, solely to the extent necessary for [me] to technically administer, display and operate the Services.
“7. The restrictions to the license depend upon the scope of the ‘Services’ definition. But this is the very broad ‘Dropbox websites and services.’ Not much certainty there. With this much looseness in the terms, I don’t see Dropbox looking that attractive as a small business alternative to Sharepoint. Which makes me think it would be interesting to take a look at Microsoft’s terms on its Web Apps offering, and Google’s on e.g., google.docs.”
Albert Chu: Simple is good, but not at the expense of clarity. Tell me what you mean by being precise!
IP licensing lawyer Albert Chu bypasses speculating over what Dropbox may have “meant” and goes right to parsing what the words and sentences of the TOS allow. For Albert, “intent” is a metaphor for the gloss (the interpretive aid) represented by the Dropbox blog post. Interesting that Albert (who had not read this post when he sent his response) cites Venkat on the significance of that Dropbox post!
“I took a look at the DropBox Terms and their blog. Let me start by commenting on your question: Is Dropbox asking for a license where a simple use right would do.A license is a form of formal permission. A simple use right would be a permission that is accomplished through a license. So the question is really more about whether the scope of permission in the license is too broad.
“Their license terms state: ‘By submitting your stuff to the Services, you grant us (and those we work with to provide the Services) worldwide, non-exclusive, royalty-free, sublicenseable rights to use, copy, distribute, prepare derivative works (such as translations or format conversions) of, perform, or publicly display that stuff to the extent reasonably necessary for the Service. This license is solely to enable us to technically administer, display, and operate the Services.’
“Normally, I like plain simple English in contracts. However, simplicity cannot come at the expense of precision or clarity. There are parts of this language that leave me wondering.
“First, the license extends to ‘those we work with to provide the Services’ – who are these folks? Are they employees, agents, subcontractors, vendors, the janitor? It’s also important to note that these folks have the right to further sublicense the rights given the placement of the right to sublicense in the sentence. Who else could they pass ‘your stuff’ to?
“Second, this group is granted a fairly broad set of rights to ‘your stuff’ ‘to the extent reasonably necessary for the Service’ – certainly more than the right to use. Based on their service, a use right wouldn’t be enough. While I think the rights that they’ve enumerated should cover what it is that they’re doing, what does ‘to the extent reasonably necessary for the Service’ mean? I think they try to clarify that with the follow-on sentence that states ‘This license is solely to enable us to technically administer, display, and operate the Services.’ OK – that helps to narrow the scope somewhat – but to the extent that there is anything marginally useful in ‘your stuff’ that they could apply to the running of their business, the license appears broad enough for them to take and use that for their own benefit, so long as it’s related to operating the Services. Thus, for example, could they data mine the content of your stuff’ to provide targeted advertising? Arguably so if that is a part of the Service. The definition of ‘Services’ is itself circular – ‘Services’ means the Dropbox websites and services. I think they could narrow this language further if they said something along the lines of ‘solely to the extent reasonably necessary for providing the Service to you’ or something along those lines. In other words, their license to your stuff can only be used for your benefit. They could further add a restriction that your stuff’ cannot be used for any other purpose.
“Third, what is interesting about this language is some of the ‘magic words’ that are missing – I note this license makes no mention of whether the rights are temporary or perpetual, revocable or irrevocable. So what happens if you decide to pull your stuff’ off of their service? Think about that in the context of their finding something useful in ‘your stuff’ for their business.
“Finally, I find the blog interesting. What effect does the blog have on the Terms of Service themselves. To the extent they purport to clarify the intent behind these terms, can we look to the blog as extrinsic evidence of intent? Does the blog become incorporated into the Terms of Service? Think about this in the context of CX Digital Media, Inc. v. Smoking Everywhere, Inc., 09-62020-CIV-Altonga (S.D. Fl.; Mar. 23, 2011) where a contract was modified as a result of an instant messaging exchange. There’s a great post by Venkat Balasubramani on Eric Goldman’s blog on this case.
“Just some thoughts off the top of my head. I look forward to seeing how your experiment works out.”
Attorney William Carleton is a member of McNaul Ebel Nawrot & Helgren PLLC, a Seattle law firm. He works with startups and emerging tech companies, their founders and investors.
He posts regularly about tech-related legal issues on his blog, where a version of this post first appeared.
