Changing Terms of Service? Be Ready For A Class Action Lawsuit

Attorney Mark D. Rasch is the former head of the U.S. Justice Department's computer crime unit and today is a lawyer in Bethesda, Md., specializing in privacy and security law.

Think you have complete control of the terms of service (TOS) of your website? As a retailer, you probably assume that you can dictate terms to customers, especially about any services you offer them besides selling them merchandise. And when photo-sharing website Instagram changed its terms of service in mid-January of this year, it probably didn't expect too many people to even notice. Those who did might be displeased with the changes, and might abandon the service or go to another one. But what Instagram should have expected was a class-action lawsuit.

And just such a suit was filed on July 16 in California Superior Court in San Francisco.

At issue in the litigation was the change in Instagram's copyright policy. The prior policy indicated that Instagram did not claim any ownership rights in people's photographs. The new policy states that Instagram "does not claim ownership of any Content that you post on or through the Service. Instead, you hereby grant to Instagram a non-exclusive, fully paid and royalty-free, transferable, sub-licensable, worldwide license to use the Content that you post on or through the Service, subject to the Service's Privacy Policy, available here, including but not limited to sections 3 ("Sharing of Your Information"), 4 ("How We Store Your Information"), and 5 ("Your Choices About Your Information"). You can choose who can view your Content and activities, including your photos, as described in the Privacy Policy."

Instagram also changed its limitations on liability to be more favorable to themselves, and grant themselves additional remedies. You really didn't expect changes that would favor the consumer, did you?

The relationship between websites and their users is, for the most part, a creature of contract law. While the underlying business being promoted may be regulated, and there may be laws on marketing and promotion (e.g, deceptive trade practice or lawyer advertising rules), issues like ownership of intellectual property, privacy rights, rights to exploit content, liability, remedies, venue and jurisdiction are "negotiated" by contract.

Problem is, they aren't really ever negotiated. They are dictated by the website operator, who frequently reserves the right to change these terms at will, simply by, well, changing them. In many cases, it is the consumer's obligation to check the website to find out that the terms have changed.

Typically, you "agree" to a contract by either signing the contract (clicking "I agree") or engaging in conduct which demonstrates assent ("by using the service you agree to these terms"). But after you have already agreed to a contract, and the other party, dissatisfied with the agreement they have negotiated (especially here when they wrote it), wants to change it, this is typically called a "novation" to the contract. For a "novation" to be effective there has to be some consideration for the change—essentially a new contract.

Ordinarily, website operators get around this requirement in several ways. First, they write in the original contract that they can change the terms at any time with or without notice. It's like Big Jule in Guys and Dolls, who plays craps with blank dice: "I had the spots taken off for luck. But I remember where the spots formerly were." A contract which can be changed at any time by one party typically is not a "binding contract." But somehow courts have let website operators get away with this.The second thing website operators do is to state that by continuing to use the service (or visit the website—presumably doing more than just reading the new terms of service) after the change in the policy, the consumer has magically agreed to the new terms—not just with respect to the data collected after the terms go into effect, but with respect to data previously collected.

The third thing some courts have done to bend over backwards to help out website operators is to simply say that terms in a TOS are not even a binding contract, but rather are a statement of policy. So to the extent that they bind the website operator, they are just a policy statement, and aren't binding. But to the extent they do things like the Instagram TOS—effect an assignment of intellectual property rights under Title 17 of the United States Code, they are binding on the consumer/assignee. Pretty neat. The website operator isn't bound and can change the "policy" anytime, but the consumer is bound to the contract.

The problem for website operators is what to do with those who opt out. If, for example you change your privacy policy, data use policy or copyright policy and people say "no," you have effectively created two classes of information: information collected under the old policy, and information collected under the new. Making more changes creates more classes of information. Each bit of information must then be tagged with the appropriate limitations so you don't use data collected under one policy or for one reason for purposes permitted by a different policy. If you don't have the ability to segregate, tag or delete the data, then you may have serious legal problems.

And that's one of the problems facing Instagram. According to the complaint, a user could only "opt out" of the new Instagram copyright policy by ceasing using the service entirely. But even then, the photos they had previously uploaded would not be deleted, although they would lose the ability to access them. Thus, the consumer would transfer their rights to their copyrighted photographs simply by doing nothing. Well, nothing except filing a class action lawsuit.

This is why you can be sure some customers will review anychanges of TOS or policy prior to posting, and they need to have appropriate means to effectively opt out of such changes.

The change in Instagram's policy may not be as severe as noted. There is a legal distinction between disclaiming ownership and disclaiming ownership rights. When you post pictures on Instagram, you do transfer certain rights to Instagram, whether you mean to or not. Instagram has the right to host the pictures, to make cache copies, to display or transfer them to people to whom you direct, to make backup and storage copies, archival copies, to examine the photos for quality control and possibly other purposes, and to comply with lawful demands or court orders for materials. They may also have the right to remove or delete the photographs and to respond to demands related to infringement under the DMCA and other copyright law. They had these rights under the old policy, even though it didn't say that. The policy change may simply be making explicit what the old policy made implicit.

Or maybe not. Maybe Instagram intends to make new uses of your pictures of your nacho cheese dip. It's hard to say. If they are, they would be better off stating so clearly and distinctly. Maybe that would avoid a future class action lawsuit.

If you disagree with me, I'll see you in court, buddy. If you agree with me, however, I would love to hear from you.