UPDATED – Brady, the Terms of Service Avenger! Dropbox edition

You totally own all the rights to this, right?

After a couple of recent security snafus, at least one of which was chalked up to users just not understanding the Terms of Service, Dropbox has updated its legal documents and is notifying users today via email.

This, of course, sparked a new wave of internet complaining – this time about the copyright license included in the Dropbox TOS. Now, I’ve talked before about how broad copyright licenses are pretty standard for any web service that allows contribution or upload of copyrightable materials. I think most of us would agree that this is preferable to a TOS that asserts actual ownership of the copyright in anything submitted to the site, which is also not uncommon (I’m looking at you and your paragraph 18, Avvo…).

The current Dropbox TOS reads, in part:

We sometimes need your permission to do what you ask us to do with your stuff (for example, hosting, making public, or sharing your files). By submitting your stuff to the Services, you grant us (and those we work with to provide the Services) worldwide, non-exclusive, royalty-free, sublicenseable rights to use, copy, distribute, prepare derivative works (such as translations or format conversions) of, perform, or publicly display that stuff to the extent we think it necessary for the Service. You must ensure you have the rights you need to grant us that permission.

That’s pretty standard. Except, hang on, Dropbox isn’t some sort of user generated content website. It’s a place for users to store their files, primarily, I think, for personal use. So, as they say, WTF?

This looks to me like an overly cautious attempt for Dropbox to cover its butt for copyright infringement for making multiple backups of user files (er… “stuff”). Or converting them to different formats. Or transmitting them and storing them in another country. All of which sound fairly reasonable. So why does Dropbox make the TOS sound like they’re going to take that screenplay you’ve been working on for four years (and have been backing up to Dropbox) and sell it to Fox (sublicensable right to publicly perform)? Or take the novel you’ve written about a scurvy ridden pirate ship sailing up the Mississippi and turn it into a Broadway musical (sublicensable right to create derivative works and to publicly perform)? Or, god forbid, take the sassy pictures you had taken as a 10th anniversary gift to your wife and print them out and plaster them around New York City (right to publicly display “stuff”)?

Ok, then. Deep breath. Reality check. All of these rights you grant to Dropbox only pertain to the “Services.”

By submitting your stuff to the Services, you grant us … [various rights in your] … stuff to the extent we think it necessary for the Service.

Ok, so what are the services? Let me consult the TOS.

Thank you for using Dropbox! These terms of service (the “Terms”) govern your access to and use of Dropbox (“we” or “our”) websites and services (the “Services”), so please carefully read them before using the Services.

So, the Services are Dropbox’s website and services. Bokay. The Services are the services. However,

[Dropbox] may stop, suspend, or modify the Services at any time without prior notice to you. (emphasis mine)

This basically leaves all of your stuff wide open for whatever. Also, given that there is nothing in the TOS saying how one might withdraw the license granted via the TOS, or when such a license might expire (one would assume it would expire upon the deletion of the account, but the TOS doesn’t say that). Dropbox’s ability to stuff with your stuff may well be perpetual.

A Terms of Service is a contract. It is an agreement between a web service provider and the user of what each person’s responsibilities are, and it governs the relationship between the parties. The purpose of a contract, contrary to popular belief, is not to set a litigation trap. You’re not supposed to use contracts just to trick the other party by using wacky legal-speak and roundabout sentence structure. They’re supposed to be about setting out the expectations of a relationship, specifically to *prevent and avoid* a conflict that would lead to a law suit. So, a good contract is a clear contract, with definitions clearly spelled out, and in language understandable by the people expected to follow the rules in the contract. But at the same time, if the relationship does break down, the contract has to make sense to a judge, and has to be enforceable at law. This is a delicate balance and can call for some seriously careful drafting.

Dropbox failed in achieving that balance, unfortunately. I think they did a couple of things right. For one, the TOS page is really easy to read and not ungodly long. It’s not as good as some, though. Dropbox also made an attempt to use the parlance of the people, referring to “stuff” as the subject of most of the Terms of Service:

By using our Services you may give us access to your information, files, and folders (together, “your stuff”). You retain ownership to your stuff. You are also solely responsible for your conduct, the content of your files and folders, and your communications with others while using the Services.

Problem is, Dropbox didn’t limit “your stuff” to the information, files, and folders *which you actually put on Dropbox.* So all the rights you gave to Dropbox to “your stuff” applies, according to this contract you’re agreeing to by using the Dropbox service, to all of your “information, files and folders,” some of which you “may” have given Dropbox access to. And while judges to give some credence to the actual intent of the parties in interpreting a contract, this is still bad drafting.

Lastly, I’d like to point out that the TOS states:

You must ensure you have the rights you need to grant us that permission.

If we keep wandering down the logical path I’ve laid out for us, this statement means that by using Dropbox you are agreeing to a contract which says you own the copyright to everything on your computer.

If:

1. “your stuff” is all your information, files and folders, whether or not they’ve been put into your Dropbox account; and
2. you give permission (a license) to Dropbox to do pretty much anything with “your stuff” in connection with “Services” (which have no defined limit); and
3. you also promise in this contract that you “have the rights you need to grant [Dropbox] that permission”

…then having anything on your computer (information, files or folders!) that contains material for which you do not own the copyright (say, perhaps, software? music? movies? a pdf of an article? a photo taken by your grandma?) is a violation of the Dropbox Terms of Use.

I hope this doesn’t keep you up at night.

So, on July 6, 2011, Dropbox changed its TOS again. They replaced the license grant section with the following:

…By using our Services you provide us with information, files, and folders that you submit to Dropbox (together, “your stuff”). You retain full ownership to your stuff. We don’t claim any ownership to any of it. These Terms do not grant us any rights to your stuff or intellectual property except for the limited rights that are needed to run the Services, as explained below.

We may need your permission to do things you ask us to do with your stuff, for example, hosting your files, or sharing them at your direction. This includes product features visible to you, for example, image thumbnails or document previews. It also includes design choices we make to technically administer our Services, for example, how we redundantly backup data to keep it safe. You give us the permissions we need to do those things solely to provide the Services. This permission also extends to trusted third parties we work with to provide the Services, for example Amazon, which provides our storage space (again, only to provide the Services).

To be clear, aside from the rare exceptions we identify in our Privacy Policy, no matter how the Services change, we won’t share your content with others, including law enforcement, for any purpose unless you direct us to. How we collect and use your information generally is also explained in our Privacy Policy…

This sure doesn’t fix all the problems, but it does something, I guess. It seems from the comments on the blog post that this new section is easier for laypeople to read. But I guess not lawyers. To me it is still a hot mess.

I’m very glad that they’ve limited “stuff” to the files and information you submit to Dropbox. And clarified that they’ll only use your “stuff” for “things.” Uff. Is that the only way they can think of to talk to non-lawyers? “You provide us with the dealibobs that you put in your Dropbox dohicky (together, your “stuff”) and we will use it only for things.”

And they still haven’t defined “services.” They give a couple of examples of what your information might be used for, but those are clearly designated as examples. So who knows what other things they might be. And since Dropbox is still reserving the right to change the “services” any time they want, you’ll never know what you’re really giving them permission to do.

They need to nail down what the “services” means. I usually do this by referencing one of the main pages of the website. For example - “Services” means the Dropbox website and services as listed on the Dropbox features web page (dropbox.com/features), as updated from time to time. That way, anyone who wants to can go check and see what exactly they’re giving Dropbox permission to use. Most people won’t check it out because most people don’t care. But this way at least there’s some documentation of what the “services” are at any time. And you can avoid all the messy attempts at explanation and examples.

Finally, the new term “You retain full ownership to your stuff.” should read “You retain full ownership of your stuff.” This is really no time to be abandoning proper prepositions, Dropbox.

Sheesh.