Monday, August 29, 2011

EA: If you don't like our privacy policy then don't play our games

As discussed at The Escapist and other outlets, the end user license agreement (EULA) for EA’s Origin service contains some decidedly unfriendly terms. For those not-in-the-know, Origin is EA’s platform for digital distribution and, according to the marketing folks at EA, “lets you purchase and play your favorite EA games - any time and any place you want.” The platform also allows you “create a profile, connect and chat with your friends, share your game library, and effortlessly join your friends' games.” Best of all: “Origin lives where you live. On your mobile phone, on your desktop and on the web, Origin is always there.”

Wow - Origin sounds like a great service!

That is, until you become more familiar with the terms of the agreement and don’t happen to be a big fan of Orwellian thinkspeak.
To explain why Origin is so user-unfriendly, first a brief explanation of EULAs. An End User Licensing Agreement (EULA) tells the user of a product or service what they are legally allowed to do with that product or service. They are somewhat controversial, in part because it is argued that consumers often wind up with only two choices: either (a) “take it” or (b) “leave it.” Despite this criticism EULAs have usually been upheld by the courts to be valid as long as the buyer had the opportunity to review the EULA prior to accepting.

The Origin EULA appears to be very broad and somewhat ambiguous, potentially making all of the user’s hardware, software, data, and internet usage available to EA in exchange for the ability to play some EA games. I’ll point out that this particular EULA might (or might not) be similar to those used by other companies. Regardless, even if this represents standard practice for the industry, it does not change the fact that this represents an unacceptable bargain for users.

Based on the Origin EULA, EA Product EULAs, and associated EA Privacy Policy it appears that installation of Origin is required in order to play some EA games at all (either bought online or offline)  and also appears to be required for all game patches. Although Origin can later be uninstalled, according to EA, “… in order to use [Origin] and certain EA products, you must leave [Origin] installed on your computer.”

The data that can be collected includes “your computer, hardware, media, software.” If that wasn’t broad enough for you, EA can also collect “technical and related information that identifies your computer (including the Internet Protocol Address) and operating system, as well as information about [Origin] usage (including but not limited to successful installation and/or removal), software, software usage and peripheral hardware.” Basically this provides them with all hardware and software information, including media (e.g. songs, pictures, videos) and arguably all data (depending on how one defines “software usage”).

It gets better: EA can also collect “certain non-personal demographic information including gender, zip code … mobile device, including device IDs ….” and “other data that you may provide in surveys, via your account preferences and online profiles such as friends lists or purchases.”

But wait, there’s more: “We may also receive either non-personal or public information from third parties in connection with market and demographic studies and/or data that we use to supplement personal information provided directly by you.”

And if their willingness to peek into every aspect of your computer isn’t enough they also grant themselves the right to view how you use the internet including “domain names and types, landing pages, pages viewed and the order of those pages, the date and amount of time spent on particular pages, other Internet and website usage information.”

They then go on to describe the numerous methods in which they can gather this information, including online and mobile purchases, game registration, marketing surveys, cookies, and “other technologies.” Hmm, what other technologies you may ask? Flash cookies, clear GIFs, tracking pixels, game system IDs,  IP addresses, server log files, web beacons, mobile or other hardware device ID, “and other similar information.”

Now that they have access to everything but your blood type (possibly covered elsewhere) they then say that “[t]he third party analytics companies … may combine the information collected with other information they have independently collected from other websites and/or other online or mobile products and services relating to your activities across their network of websites as well as online and/or mobile products and services.”

Fortunately EA is happy (literally) to remove your info upon request: “[w]e will be happy* to review, update or remove information as appropriate. We may still retain your information in our files however, to resolve disputes, enforce our user agreement, and due to technical and legal requirements and constraints related to the security, integrity and operation of our websites.” *[See, I told you so.]

All happiness aside, the fact that they can retain your info to enforce their user agreement could be construed fairly liberally (read: we can keep your info as long as we argue that it’s necessary).

If all of this wasn’t bad enough, EA can change these agreements at any time and their only obligation to notify you of the change in terms is to post it on their site. Your continued use after a change indicates that you’ve accepted those new terms. Likewise, EA can update the Origin software (automatically of course) as long as EA considers that update to be “reasonable, beneficial to you and/or reasonably necessary.” Fortunately you can refuse to accept a new agreement or update but your refusal means that you must delete the Origin software, thereby crippling your game.

To be fair, EA has its own obligations. For many of the games they promise to provide one month notice before shutting down the online service stating, “EA may TERMINATE online features after 30 days notice posted on” I would suggest that if you’re installing Origin you might want to bookmark a few EA sites so that you know when your rights have been unilaterally changed.

Although these terms could be argued and litigated in court, the time and expense involved makes it unlikely that individual consumers would bother. Like many (most?) corporations EA has included an arbitration clause in an attempt to prevent most lawsuits and most importantly to prevent class action suits.

But don’t fret, because you do have some options. As EA clearly states in their privacy policy: “These ad serving technologies are integrated into our sites, online or mobile products and services; if you do not want to use this technology, do not play.”

Sounds like a plan.