Housekeeping Notice: Part 1 can be found here, where I examine the Frequently-Asked Questions section of the notice I received. There will be a Part 3, where I look at the updated Oculus Privacy Policy. (UPDATE Oct. 14h, 2020: Here is Part 3.)
So, this afternoon, I decided to dive into the legalese of the updated Oculus Terms of Service and Privacy Policy documents, which all Oculus VR device users who choose not to merge their Facebook and Oculus accounts need to sign before they can continue to use them. As I wrote last week, and I repeat here now:
I AM NOT A LAWYER, AND YOU SHOULD CONSULT A REAL LAWYER IF YOU HAVE ANY QUESTIONS ABOUT THIS. In fact, I would welcome comments from actual lawyers who deal with this sort of corporate legalese every day, and can explain it far better than I ever could to your average consumer. Most end-users simply scroll through such documents and sign off on them without reading them thoroughly (and Facebook is not alone among large companies that count on that).
Note that if you do elect to merge your Oculus and Facebook accounts, you will be asked to sign off on different documents than these. Since I have deleted my Facebook account in protest of this move, I do not fall into this category of user. Note also that new Oculus device users (including the Oculus Quest 2) will required to set up Facebook accounts in order to use their headsets:
The Updated Oculus Terms of Service
If you click on “Oculus Terms of Service” link in the announcement I received, you are taken to an Oculus page with the bold title of LEGAL DOCUMENTS:
First, a few stats: I ran the ToS text itself (without the title and the headings on the left-hand side) through a word counter program called WordCounter, where it came in at 8.978 words arranged in 326 sentences, with an average sentence length of 28 words. Lots and lots of long-winded legal sentences to parse here! This means that it would take a little over half an hour to read for the average reader. (Good thing I brewed a vat of black coffee to power through this! I’m gonna need it.)
The reading level is calculated by WordCounter to be “college graduate”. Since only a third of U.S.-born Americans have a four-year college degree, it means that roughly two-thirds of Americans will likely encounter some difficulty in reading and understanding the Terms of Service (provided that they would be willing to set aside half an hour to read through the whole thing from beginning to end in the first place).
The preface reads as follows:
On 11 October 2020, we are updating the Oculus Terms of Service to reflect that Facebook, Inc. (or Facebook Ireland Limited for European Region users) will become responsible for the Oculus platform and your Oculus information. Below you can find a preview of the updated Terms of Service, and we recommend that you review them. It will be available to review in other languages soon. By continuing to use an Oculus account after 11 October 2020, you agree to the updated Oculus Terms of Service.
Right up front, in all-caps bold, is the following warning (which I cut and pasted into Microsoft Word, using the case change feature to make it more readable here):
These terms of service contain important terms and conditions that affect you and your use of the oculus products, including, unless you choose to opt out, a provision regarding binding arbitration of disputes (other than certain specified intellectual property claims and small claims) and a waiver of certain rights to jury trials and/or class actions. Please read the “Dispute Resolution” section (section 19) in its entirety…
You certify that you are of the legal age of majority in the jurisdiction in which you reside or, if you are between the ages of 13 and the legal age of majority, that you are using the Oculus products with the supervision of your parent or legal guardian who agrees to be bound by these terms of service. Make sure that you review these terms of service with your parent or guardian so that you both understand all of your rights and obligations.
Which raises an interesting question: what happens if you are younger than 13? A little later on it, the ToS states:
The Oculus Products are intended solely for users who are aged 13 years or older. Any registration for, or use of, the Oculus Products by anyone under the age of 13 years is unauthorised and unlicensed and breaches these Terms.
As far as I am aware, you have to be at least 13 years old to have a Facebook account (although I’m quite sure some children lie about their ages to set up account, just as some people use a fake name). However, I’m quite sure that the Oculus Quest 2 is going to be popular with both children and teenagers, and I can easily foresee a situation where someone under 18 buys a Quest with their own money and sets it up without any adult “supervision”. The wording suggests that the legal onus would rest with the legal guardian, which means that some parents might well be faced with a nasty surprise down the line (especially if they have sensibly forbidden their children from setting up accounts on social media).
Anyway, onwards! (Takes another gulp of rapidly-cooling black coffee, steels himself)
If you are using the Oculus Products on behalf of any entity, you represent and warrant that you are authorised to accept these Terms on such entity’s behalf and that such entity agrees to be responsible to us if you or that entity breaches these Terms.
Now, I happen to have an Oculus Rift I purchased for work, for a virtual reality research project which is currently on hold (more details here). It, and the high-end Windows PC required to use it, were purchased using University of Manitoba money and are U of M property (although the Rift is currently sitting in my messy apartment as I work from home during the pandemic, along with my office chair, keyboard, and mouse).
Am I, indeed, authorized to accept these Terms of Service on my university’s behalf? I suspect that the University lawyers would want some input in that decision; they review legal contracts for software and services all the time as a matter of course. This is a question which I will have to ask my colleague, the law librarian at the University of Manitoba, who is both a librarian and a lawyer.
Again, this is another potentially thorny legal for those businesses and educational institutions which bought Oculus Rifts, Quests, and Gos (Go’s? Goes?) for commercial and corporate use, well before the requirement to set up a Facebook account. What if your organization forbids employees from setting up Facebook accounts?
I am reminded of a recent, similar ethical and legal situation, which many public libraries who had purchased access to the popular Lynda.com educational programs for their library patrons were faced with. Lynda.com was acquired by LinkedIn, which required users to set up LinkedIn accounts in order to use it, something which many public libraries said contravened their policies. I’m actually not sure what the end result was, and so I will have to go do a little librarian research on it and report back later! More rabbit holes to go down!!
Onwards!! (Takes sip of microwaved coffee, grimaces)
People can only have meaningful interactions if they feel safe. We employ dedicated teams and develop advanced technical systems to detect misuse of our service, harmful conduct towards others, breaches and violations of our terms and policies, and situations where we may be able to help support or protect the Oculus community. If we learn of content or conduct that misuses our Oculus Products or breaches or violates our Terms and policies, we will take appropriate action, for example, by removing content, blocking access to certain features, disabling an account or contacting law enforcement agencies. We share information with other Facebook Companies (https://www.facebook.com/help/111814505650678/) when we detect misuse or harmful conduct by someone using one of our Oculus Products.
All well and good. Facebook plays judge, jury, and (if necessary) executioner; this is no different than other services. I do find it interesting that Instagram is not mentioned by name in the linked list of “Facebook Companies”, but WhatsApp is. I’m quite sure there is a much more detailed list of Facebook companies somewhere (aha, here’s one! Wikipedia to the rescue!).
To access and use certain features of the Oculus Products, you may be required to register for an account. By creating an account, you agree to: (i) provide accurate, current and complete account information; (ii) maintain the security of your password, not share your password with any other person and accept all risks of unauthorised access to your account; and (iii) promptly provide notice at https://www.facebook.com/whitehat/ if you discover or otherwise suspect any security breaches related to the Oculus Products.
Another potentially thorny legal issue: I plan to donate my original Oculus Quest to my sister-in-law’s workplace, where she is part of a team of people who work with developmentally challenged adults. It would appear that you are required to “not share your password with any other person”, which is patently absurd in such a situation, where multiple people will be using the device. I have no doubt that many people are sharing an Oculus account for a particular device, who are in similar situations.
We reserve the right, at our sole discretion and where technically feasible, to disable your access to or ability to use Oculus Products that we believe present a health and safety risk or violate our Community Standards (also known as the Facebook Rules) and Conduct in VR Policy, agreements, laws, regulations or policies. We will not incur any liability or responsibility if we choose to remove, disable or delete such access or ability to use any or all portion(s) of the Oculus Products.
Once again: Facebook is judge, jury, and executioner. You have zero say in the matter (although I’m quite sure there will be some sort of appeals process, which of course will be completely structured and controlled by Facebook).
There’s an interesting section called Virtual Items:
Your purchase of a virtual item or in-game currency within the Oculus Products is a payment for a limited, non-assignable licence to access and use such content or functionality in the Oculus Products. Virtual items (including characters and character names) or in-game currency purchased or available to you in the Oculus Products can only be used in connection with the Oculus Products where you obtained them or where they were developed by you as a result of gameplay. These items are not redeemable or subject to refund and cannot be traded outside the Oculus Products for money or other items for value. We may modify or discontinue virtual items or in-game currency at any time.
I wonder what the impact of that statement would be on some social VR platforms that currently operate on the Oculus Rift and Quest.
The Acceptable Use section states:
By accessing or using the Oculus Products, you agree that you will not: (a) access or use the Oculus Products in any manner that could interfere with, disrupt, negatively affect or inhibit anyone from fully enjoying the Oculus Products, including, but not limited to, defamatory, harassing, threatening, bigoted, hateful, vulgar, obscene, pornographic or otherwise offensive behaviour or content; (b) damage, disable, overburden or impair the functionality of the Oculus Products in any manner; (c) access or use the Oculus Products for any illegal or unauthorised purpose or engage in, encourage or promote any illegal activity, or any activity that breaches or violates these Terms, Community Standards (also known as the Facebook Rules) and Conduct in VR Policy or any other terms or policies provided in connection with the Oculus Products; (d) use or attempt to use another user’s account without authorisation from such user; (e) modify, adapt, hack or emulate the Oculus Products; (f) use any robot, spider, crawler, scraper or other automated means or interface not provided or authorised by us to access the Oculus Products or to extract data; (g) circumvent or attempt to circumvent any filtering, security measures or other features designed to protect the Oculus Products or third parties; or (h) infringe upon or violate our rights or the rights of our users or any third party.
This statement (particularly section (f) above) might cause some serious problems for security researchers, and tech reporters writing about computer security issues, who might use such methods to take a peek at exactly what data Facebook/Oculus is collecting on its users. For example 9to5Mac reported:
A new investigative report from The Wall Street Journal today looks into the controversial practice of popular third-party iOS and Android apps sending very personal user data to Facebook. In some cases, this happened immediately after an app recorded new data, even if the user wasn’t logged into Facebook or wasn’t a Facebook user at all. Notably, the report highlights that Apple and Google don’t require apps to divulge all the partners that user data is shared with.
And in one particularly disturbing case, Flo, a period-tracking app used by many women, was caught sending health data to Facebook, without the users’ knowledge or consent:
After The Wall Street Journal reported that popular period-tracking app Flo had been secretly sharing some of its users’ most personal health data with Facebook, Flo is promising to make some changes.
Along with a number of other popular health apps, Flo used Facebook’s developer software to track users’ data in a way that could be used for advertising purposes, the report found.
If we can’t trust Facebook not to do these kinds of things now, what guarantee do we have that they won’t continue to invade our privacy in other ways, using data from our VR headsets (tracking, eye movements, etc.)? Public service journalism demands that sometimes you need to reverse engineer or use other methods to investigate security concerns, such as the case with Flo.
Our Oculus Products may include interactive features and areas where you may submit, post, upload, publish, email, send, otherwise transmit or interact with content, including, but not limited to, text, images, photos, videos, sounds, virtual reality environments or features, software and other information and materials (collectively, “User Content”). Unless otherwise agreed to, we do not claim any ownership rights in or to your User Content.
All well and good. However:
By submitting User Content through the Oculus Products, you grant us a worldwide, non-exclusive, transferable, royalty-free and fully sublicensable (i.e. we can grant this right to others) right to use, copy, display, store, adapt, publicly perform and distribute such User Content in connection with the Facebook Company Products (https://www.facebook.com/help/195227921252400/) (subject to applicable Privacy Settings [https://secure.oculus.com/my/privacy/]).
I’m quite sure that most people are not aware that, despite Oculus not owning your content, that they can do essentially whatever they want with it, anyway, if you are submitting that content through Oculus devices. News to me, and it might be unwelcome news to you, too. (Do other brands of VR headset makers do this?)
We do not endorse or guarantee the opinions, views, advice or recommendations posted or sent by users. Facebook has no responsibility or liability for User Content made available through the Oculus Products, and we have no obligation to screen, edit or monitor such content. However, we do reserve the right, and have absolute discretion, to remove, screen or edit User Content at any time and for any reason, including content that infringes intellectual property rights or otherwise breaches these Terms.
This last bit is interesting, in light of Facebook’s determination to uphold community standards in places such as Facebook Horizon by invisibly observing user behaviour. Basically, although they will obviously try to clamp down on offensive or otherwise undesirable behaviour, they are covering their asses here by stating “Facebook has no responsibility or liability for User Content made available through the Oculus Products, and we have no obligation to screen, edit or monitor such content“. (I’m quite sure that such statements are common boilerplate in most Terms of Service agreements.)
ONWARDS!!! (Props open his eyelids with toothpicks)
You will comply with all applicable export control laws of the United States and any other applicable governmental authority, including, without limitation, the US Export Administration Regulations (“Export Laws”). You will not, directly or indirectly, export, re-export or download the Oculus Products: (a) to any individual, entity or country prohibited by Export Laws, including by any US sanctions programme; (b) to anyone on the SDN List, the US Denied Persons List or Entity List or other export control lists; or (c) for any purpose prohibited by Export Laws, including nuclear, chemical or biological weapons proliferation or the development of missile technology. You further represent and warrant that no US federal agency has suspended, revoked or denied your export privileges and you are not listed on the SDN List.
I love the bit about “nuclear, chemical or biological weapons proliferation or the development of missile technology“. Talk about covering all the bases!
This next bit applies to me as a blogger:
You are granted a limited, non-exclusive right to create text links to our websites for non-commercial purposes; however, you may not use our logos or other proprietary graphics to link to our sites without our express written permission.
So basically I can’t use any Facebook/Oculus logos to link to their websites (although text links are acceptable). I wonder if all the third-party app websites that use such logo links to their Oculus Store listings are aware of this stipulation.
The rest is all disclaimers and indemnities and so forth, limitations of liability statements, etc. Under Dispute Resolution, it states:
You and Facebook agree to waive any right to a jury trial, or the right to have any Dispute resolved in any court, and instead accept the use of binding arbitration (which is the referral of a Dispute to one or more impartial persons for a final and binding determination); provided, however, that you have the right to litigate any Dispute in small claims court, if all the requirements of the small claims court, including any limitations on jurisdiction and the amount at issue in the Dispute, are satisfied…
You and Facebook agree that any Dispute is personal to you and Facebook, and that any Dispute shall only be resolved by an individual arbitration and shall not be brought as a class arbitration, a class action or any other representative proceeding.
So, no class action lawsuits! Facebook wants to pick you off, one at a time 😉
The document ends with a special section pertaining to German users and to European Union users. God help the German users! All they get is a separate document which basically replaces selected text from the original Terms of Service document, so they have to go back and forth between two legal documents to figure out what the hell is going on.
I hope you found this little road trip as fascinating as I did! Stay tuned for Part 3, where I examine the updated Oculus Privacy Policy.
