The important quote: "Looking at some of Google's competitors, it's clear that they need the exact same permissions — they just use slightly more artful language to communicate them."
All of these services need similar permissions, as do most web services: it's just an artifact of how our copyright law works. Google does a bad job of expressing that reality as nicely as others (like Dropbox), but with almost equivalent permissions, I'd put them pretty far down on the list of companies not to trust.
Excellent article. I particularly liked this observation regarding verbiage in the Dropbox TOS: "That language is definitely friendlier than Google's, but it's actually more expansive, since it's more vague."
As laypersons, we may feel more comfortable when companies avoid legalese and use straight talk, but that doesn't mean we are any more safer or protected.
The article posted here on HN cheats by including an important sentence from the DropBox TOS and sneakily omitting the corresponding sentence from the Google TOS.
DropBox: You give us the permissions we need to do those things solely to provide the Services.
Google: The rights you grant in this license are for the limited purpose of operating, promoting, and improving our Services, and to develop new ones.
Google's is worse because it takes all rights to use your work however it likes, and then states in its privacy policy that it won't use it for anything other than to provide the service. But if it likes, it can amend the privacy policy in the future to remove or modify that limitation. So you have to trust Google, which may be fine now, but what about in 20 years? They have rights to your work forever.
Other providers clearly state that they are only taking rights to your work for the purpose of providing the service, right in the ToS. IANAL, but this seems important.
The Verge article is very good at explaining the actual details. However, although IANAL, I think they missed on one part of their explanation:
They say:
But what about that line about granting rights for "promoting and improving our Services," you ask? ... and then conclude that sort of behavior is forbidden by the Google privacy policy
but part of the Privacy Policy they quote also says:
We use the information we collect from all of our services to provide, maintain, protect and improve them, to develop new ones,...
So it would seem to me that legally that's still a fairly wide scope for what they could potentially do under the umbrella of improving existing and developing new services.
The article highlights a different part of the Privacy Policy: We will ask for your consent before using information for a purpose other than those that are set out in this Privacy Policy.
... but given the previous clause, there seems to be a pretty big umbrella of things that _are_ set out in the Privacy Policy.
I'd put them pretty far down on the list of companies not to trust.
I think this is the bottom line in both The Verge article and your comment - whether you trust the company is ultimately more important than the details of the ToS.
Complete FUD. Best article I've read on this is from The Verge. Google would be unable to create backups or thumbnails for example without these rights.
Holy cow -- Apple says they may delete any iCloud content that they find "objectionable"? And that they have a right to scan your content to determine such?
Problem is: the rights as worded by Google allow a whole lot more than the reasonable-use wording by Dropbox. Remember that recent flap about iOS apps uploading users' entire Contacts list for non-relevant uses? hey, users gave permission for the apps to access that data without explicit limits; same idea, same concerns.
No, it's not. "Publicly perform"?! Tell me in what reasonable backup scenario would google need the right to publicly perform your content? It's not reasonable at all; it's egregious and honestly insulting.
Look, I get it: the chances of Google acting on these rights are small and the PR backlash for abuse would be brutal. But this is a great example of a legal department _far_ overreaching in their corporate protection efforts.
I really want to use GDrive, but even if the odds of abuse are unimaginable, I really hate that they make me sign a contract that makes me out to be a functional idiot. "Sign away all your legal rights--it's okay because you can trust us."
Exactly. The same FUD was being spread around a while back regarding google's terms as related to photo sharing on G+. Google needs these rights to provide certain features...
Yet, with those rights, Google are able to (worldwide) ; create derivative works, communicate, publish, publicly perform, publicly display and distribute such content.
I mean "publicly perform, publicly display and distribute such content", how on earth can you formulate that so broadly for a service intended to store private files??? And how after reading that can you qualify it as "Complete FUD"?
In depth analysis are interesting and everybody here understand that google is not going to be THAT evil in the short term, but the fact this _is_ formulated like that is very interesting and not fud at all.
You may be right, but that doesn't prevent them from using those same rights for other purposes (much like TSA searches being used to find drugs rather than terrorism).
If Google really means it, and wants it to be clear, they could put it right into the TOS: "Google may do X, when it does so in order to provide feature Y".
"Some of our Services allow you to submit content. You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours.
When you upload or otherwise submit content to our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content. The rights you grant in this license are for the limited purpose of operating, promoting, and improving our Services, and to develop new ones. This license continues even if you stop using our Services (for example, for a business listing you have added to Google Maps). Some Services may offer you ways to access and remove content that has been provided to that Service. Also, in some of our Services, there are terms or settings that narrow the scope of our use of the content submitted in those Services. Make sure you have the necessary rights to grant us this license for any content that you submit to our Services.
You can find more information about how Google uses and stores content in the privacy policy or additional terms for particular Services. If you submit feedback or suggestions about our Services, we may use your feedback or suggestions without obligation to you."
I do agree that Dropbox's wording is much friendlier, but I attribute most of the difference to Google having big plans (e.g., searching and sharing) and being careful that their terms will permit them. I suspect a big part of this is Google's intention to analyze your data to make it indexed/searchable (e.g., their 'search for Mt. Everest and get back your pictures of it' features).
Really, the difference seems to be almost exclusively wording. Both licenses grant very broad powers to the service to redistribute (Google is guilty only of enumerating them more fully, where Dropbox simply claims "all the permissions we need"). Both providers include language that they will only do this in order "to provide the service", but neither enumerates exactly what that means.
Does anyone see anything specific that Dropbox can't do that Google can? That grant looks really broad to me, just ... friendlier.
If you're truly concerned about your data integrity build a TrueCrypt volume within the Goog Drive / Dropbox.
Despite what the TOS says on either end there are always going to be breaches, court orders, or potentially even employees with the power to access your files.
I have found quite a few people recommend this, and never understood the point - if all you want is a "cloud" backup of your opaque data, simply use tarsnap. cheap, easy, brilliant piece of engineering. Or heck, use backblaze with their unlimited storage plan!
The trouble with building a truecrypt volume inside GDrive/Dropbox etc is that this makes the data completely opaque to the service. You give up all integration with google docs, easy sharing via links, collaboration, everything. Why use these services at all if you don't need the features they provide over and above basic backup?
Or just use something like spideroak (with which I have no affiliation), which encrypts everything on your device before uploading it to their servers.
TC volume needs to be unmounted in order for gDrive/Dropbox to be able to sync it. For that you need to close all apps that are currently using any files on that volume. That's not exactly easy-breezy. In fact, it's a major pain in the ass, so - no, this is not a practical option.
«we don't claim ownership of the content you provide on the service. Your content remains your content. We also don't control, verify, or endorse the content that you and others make available on the service.»
« we may access or disclose information about you, including the content of your communications, in order to: (a) comply with the law or respond to lawful requests or legal process; (b) protect the rights or property of Microsoft or our customers, including the enforcement of our agreements or policies governing your use of the service; or (c) act on a good faith belief that such access or disclosure is necessary to protect the personal safety of [ppl]»
There's been several articles on this topic, and I don't understand why they all seem to ignore this line in Google's TOS: "Some of our Services allow you to submit content. You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours."
These terms are across all of Google's services, and of course they need to state these sorts of things to keep themselves covered.
“I don't understand why they all seem to ignore this line in Google's TOS.”
Because not many people are good at reading and at understanding what they read.
Which, here, is this:
Gmail or Google Docs/Drive or Google Apps are not among Google’s services that “allow you to submit content”. You don’t submit anything to them. A service like YouTube, on the other hand, is, and it obviously needs such terms in order to operate.
> Dropbox had the same issue in 2011. Their TOS was very similar to Google Drive's,
Yes but Dropbox doesn't have the reach and amount of data gathering power Google has. Google is actively monitoring hundreds to thousands of personal data gathering systems, whereas Dropbox is only a cloud storage system. There IMO lies the difference.
We may need your permission to do things you ask us to do with your stuff, for example [..]. This includes [..]. It also includes [..]. You give us the permissions we need to do those things solely to provide the Services.
So I give Dropbox full access to do things with my stuff? Seriously? IANAL, but doesn't that include more than what Google says?
Also note that Google has this line (you know, just above the paragraph that was quoted in the article): Some of our Services allow you to submit content. You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours.
> So I give Dropbox full access to do things with my stuff?
Why'd you leave out the "things you ask us to do" bit?
"You give us permission to kick you in the balls" sounds bad in a contract if you leave out the "because you're signing up to become a mixed martial arts combatant" bit, too.
How did you get to "So I give Dropbox full access to do things with my stuff?" from what Dropbox put, I personally did not interrupt it that way at all...
I'm actually not so worried about the privacy of the files I might put in GDrive. The handful of files I really care about (financial data etc) I store in other ways.
But I am worried about having my Google account yanked out from under me. I'm simply not willing to depend on one capricious company with no customer support for email, phone, storage, online collaboration, chat, social etc. Ironically the harder Google tries to squeeze all their services together the less inclined I am to use any individual service.
If I understand Google's ToS right, you are giving them a license to do pretty much anything with the data you upload to Drive. For instance, if you backup your git repo to Drive, Google's engineers have a license to take your source code and incorporate it into their own products. Now of course Google's not actually going to do that. So why not make the license say that?
Google is using a generic ToS for all their products, but it's not appropriate to products that host valuable intellectual property.
Because it's impractical to create a TOS that defines all possible ways they might need to use that data in order to provide the service (from any court's viewpoint) but also explicitly carve out that usage. If re-using the code as you posit is indistinguishable (legally) from a valid use of the data they need in order to provide the service, they're not going to carve it out of the TOS. It's better to not attempt that, and let you (as the customer) pick if you're okay with that. If you find the risk unacceptable, don't use the service. To some degree that's a better outcome than exposing the host to a ton of legal risk.
While it's obvious Google isn't planning to rape, pillage and publish your private files, their terms of service are starting on the wrong foot.
Ask for the base permissions you need and work from there. This is even more important when you're not a Google. Explain what you need and why to give them what they want from you, earn their trust and karma.
More importantly, if you sell off your company later, they will protect your users from those who might take a more liberal view of the TOS.
Dropbox writing their TOS in a way that non-lawyers can read it was a good move here. Neither TOS really effects anything being done with your data in a practical way but the PR Dropbox is getting from theirs is worth 100x the time they put into it. Nice investment.
It's the derivative works part of the T&Cs for GDrive that makes it a little wonky, I don't want to give them full license to create any derivative work but I'm happy with them making changes for technical architecture.
But that's so selective and does miss the part where they say your content and copyright is all yours, so it justifies picking on Google for being supposedly creepy.
As others have mentioned, it probably is about producing thumbnails of images or something like that.
>You give us the permissions we need to do those things solely to provide the Services.
This give Dropbox the ability to modify your images to create thumbnails as well if that's a part of their service. It also allows them to do whatever else they want without being explicit and hiding behind vague wording.
Amendment of a Privacy Policy doesn't retroactively apply the policy to all the data previously provided to the service without first consulting the user.
If that is the case then they need to make the user ACCEPT the new terms before this can be done. (This is what is happening whenever you are forced to accept an amended TOS before returning to a service.)
One thing is that the phrasing of Google's terms is more open, more importantly: I would rather like to store my files with someone that are in the business of storing files - than someone that is in the business of making "everything" searchable (for anyone?)
If any of this blather is an attempt to prevent me from giving my money to Google instead of Dropbox, mission failed. Pay 2 to 4 times as much for the same service? I don't think so. Google wins, T. K. O., pwned with a capital P.
[+] [-] Xuzz|14 years ago|reply
The important quote: "Looking at some of Google's competitors, it's clear that they need the exact same permissions — they just use slightly more artful language to communicate them."
All of these services need similar permissions, as do most web services: it's just an artifact of how our copyright law works. Google does a bad job of expressing that reality as nicely as others (like Dropbox), but with almost equivalent permissions, I'd put them pretty far down on the list of companies not to trust.
[+] [-] rsbrown|14 years ago|reply
As laypersons, we may feel more comfortable when companies avoid legalese and use straight talk, but that doesn't mean we are any more safer or protected.
[+] [-] dkarl|14 years ago|reply
DropBox: You give us the permissions we need to do those things solely to provide the Services.
Google: The rights you grant in this license are for the limited purpose of operating, promoting, and improving our Services, and to develop new ones.
[+] [-] rfugger|14 years ago|reply
Other providers clearly state that they are only taking rights to your work for the purpose of providing the service, right in the ToS. IANAL, but this seems important.
[+] [-] angusgr|14 years ago|reply
They say: But what about that line about granting rights for "promoting and improving our Services," you ask? ... and then conclude that sort of behavior is forbidden by the Google privacy policy
but part of the Privacy Policy they quote also says: We use the information we collect from all of our services to provide, maintain, protect and improve them, to develop new ones,...
So it would seem to me that legally that's still a fairly wide scope for what they could potentially do under the umbrella of improving existing and developing new services.
The article highlights a different part of the Privacy Policy: We will ask for your consent before using information for a purpose other than those that are set out in this Privacy Policy. ... but given the previous clause, there seems to be a pretty big umbrella of things that _are_ set out in the Privacy Policy.
I'd put them pretty far down on the list of companies not to trust.
I think this is the bottom line in both The Verge article and your comment - whether you trust the company is ultimately more important than the details of the ToS.
[+] [-] jshen|14 years ago|reply
[+] [-] stuartmemo|14 years ago|reply
http://www.theverge.com/2012/4/25/2973849/google-drive-terms...
[+] [-] curveship|14 years ago|reply
Jaw drop
I store at the pleasure of the King.
[+] [-] ctdonath|14 years ago|reply
[+] [-] toddmorey|14 years ago|reply
Look, I get it: the chances of Google acting on these rights are small and the PR backlash for abuse would be brutal. But this is a great example of a legal department _far_ overreaching in their corporate protection efforts.
I really want to use GDrive, but even if the odds of abuse are unimaginable, I really hate that they make me sign a contract that makes me out to be a functional idiot. "Sign away all your legal rights--it's okay because you can trust us."
[+] [-] rjsamson|14 years ago|reply
[+] [-] nooop|14 years ago|reply
I mean "publicly perform, publicly display and distribute such content", how on earth can you formulate that so broadly for a service intended to store private files??? And how after reading that can you qualify it as "Complete FUD"?
In depth analysis are interesting and everybody here understand that google is not going to be THAT evil in the short term, but the fact this _is_ formulated like that is very interesting and not fud at all.
[+] [-] RandallBrown|14 years ago|reply
[+] [-] CWuestefeld|14 years ago|reply
If Google really means it, and wants it to be clear, they could put it right into the TOS: "Google may do X, when it does so in order to provide feature Y".
[+] [-] AmazingMe|14 years ago|reply
[+] [-] 7c8011dda3f3b|14 years ago|reply
When you upload or otherwise submit content to our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content. The rights you grant in this license are for the limited purpose of operating, promoting, and improving our Services, and to develop new ones. This license continues even if you stop using our Services (for example, for a business listing you have added to Google Maps). Some Services may offer you ways to access and remove content that has been provided to that Service. Also, in some of our Services, there are terms or settings that narrow the scope of our use of the content submitted in those Services. Make sure you have the necessary rights to grant us this license for any content that you submit to our Services.
You can find more information about how Google uses and stores content in the privacy policy or additional terms for particular Services. If you submit feedback or suggestions about our Services, we may use your feedback or suggestions without obligation to you."
[+] [-] cavilling_elite|14 years ago|reply
[+] [-] chwahoo|14 years ago|reply
[+] [-] ajross|14 years ago|reply
Does anyone see anything specific that Dropbox can't do that Google can? That grant looks really broad to me, just ... friendlier.
[+] [-] aresant|14 years ago|reply
Despite what the TOS says on either end there are always going to be breaches, court orders, or potentially even employees with the power to access your files.
[+] [-] ghoul2|14 years ago|reply
The trouble with building a truecrypt volume inside GDrive/Dropbox etc is that this makes the data completely opaque to the service. You give up all integration with google docs, easy sharing via links, collaboration, everything. Why use these services at all if you don't need the features they provide over and above basic backup?
[+] [-] krupan|14 years ago|reply
[+] [-] xtrimsky_|14 years ago|reply
[+] [-] huhtenberg|14 years ago|reply
[+] [-] recoiledsnake|14 years ago|reply
[+] [-] sangaya|14 years ago|reply
http://www.google.ca/search?hl=en&source=hp&q=%22a+w...
[+] [-] unknown|14 years ago|reply
[deleted]
[+] [-] cabirum|14 years ago|reply
«we don't claim ownership of the content you provide on the service. Your content remains your content. We also don't control, verify, or endorse the content that you and others make available on the service.»
« we may access or disclose information about you, including the content of your communications, in order to: (a) comply with the law or respond to lawful requests or legal process; (b) protect the rights or property of Microsoft or our customers, including the enforcement of our agreements or policies governing your use of the service; or (c) act on a good faith belief that such access or disclosure is necessary to protect the personal safety of [ppl]»
[+] [-] timothya|14 years ago|reply
These terms are across all of Google's services, and of course they need to state these sorts of things to keep themselves covered.
[+] [-] demetris|14 years ago|reply
Because not many people are good at reading and at understanding what they read.
Which, here, is this:
Gmail or Google Docs/Drive or Google Apps are not among Google’s services that “allow you to submit content”. You don’t submit anything to them. A service like YouTube, on the other hand, is, and it obviously needs such terms in order to operate.
[+] [-] ceejayoz|14 years ago|reply
http://blog.dropbox.com/?p=846 http://blog.dropbox.com/?p=867
[+] [-] NelsonMinar|14 years ago|reply
[+] [-] whackberry|14 years ago|reply
Yes but Dropbox doesn't have the reach and amount of data gathering power Google has. Google is actively monitoring hundreds to thousands of personal data gathering systems, whereas Dropbox is only a cloud storage system. There IMO lies the difference.
[+] [-] nateberkopec|14 years ago|reply
Clearly, this is lawyer boilerplate being taken out of context.
http://www.google.com/intl/en/policies/terms/
[+] [-] brudgers|14 years ago|reply
Yes, Gmail has the same issue. Google can use your data "to develop new services" for it's own benefit.
[+] [-] judofyr|14 years ago|reply
So I give Dropbox full access to do things with my stuff? Seriously? IANAL, but doesn't that include more than what Google says?
Also note that Google has this line (you know, just above the paragraph that was quoted in the article): Some of our Services allow you to submit content. You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours.
[+] [-] ceejayoz|14 years ago|reply
Why'd you leave out the "things you ask us to do" bit?
"You give us permission to kick you in the balls" sounds bad in a contract if you leave out the "because you're signing up to become a mixed martial arts combatant" bit, too.
[+] [-] bluetidepro|14 years ago|reply
[+] [-] Zaim3|14 years ago|reply
[+] [-] cageface|14 years ago|reply
But I am worried about having my Google account yanked out from under me. I'm simply not willing to depend on one capricious company with no customer support for email, phone, storage, online collaboration, chat, social etc. Ironically the harder Google tries to squeeze all their services together the less inclined I am to use any individual service.
[+] [-] NelsonMinar|14 years ago|reply
Google is using a generic ToS for all their products, but it's not appropriate to products that host valuable intellectual property.
[+] [-] tomkarlo|14 years ago|reply
[+] [-] orbitingpluto|14 years ago|reply
Ask for the base permissions you need and work from there. This is even more important when you're not a Google. Explain what you need and why to give them what they want from you, earn their trust and karma.
More importantly, if you sell off your company later, they will protect your users from those who might take a more liberal view of the TOS.
[+] [-] ryanisinallofus|14 years ago|reply
[+] [-] nicholassmith|14 years ago|reply
But that's so selective and does miss the part where they say your content and copyright is all yours, so it justifies picking on Google for being supposedly creepy.
[+] [-] mangodrunk|14 years ago|reply
>You give us the permissions we need to do those things solely to provide the Services.
This give Dropbox the ability to modify your images to create thumbnails as well if that's a part of their service. It also allows them to do whatever else they want without being explicit and hiding behind vague wording.
[+] [-] sturmeh|14 years ago|reply
If that is the case then they need to make the user ACCEPT the new terms before this can be done. (This is what is happening whenever you are forced to accept an amended TOS before returning to a service.)
[+] [-] haraldk|14 years ago|reply
[+] [-] sampsonjs|14 years ago|reply