The Cohost TOS IP provisions are an actual problem

There is a little ritual that happens on all social websites. Someone will notice the IP licensing language in the ToS, and freak out¹. Then the entire site will freak out. Then after a day or so someone familiar with website operation will exhaustedly write a response post, explaining that IP licensing is necessary and that all UGC websites have similar language. Then the entire site will calm down. The interesting thing about this ritual is that the first part, the freaking out, happens regardless of whether the IP provisions are actually onerous/dangerous; and the second part, the calming down, also happens regardless of what the IP provisions actually say. I am not a lawyer. However I believe I know enough to parse a TOS, and I believe not all IP provisions are equal. I think some are reasonable and some are not. And unfortunately, I specifically believe Cohost's IP provisions are problematic or even dangerous. I don't believe these terms were chosen maliciously, but I believe they should be changed. The relevant provisions are in the Cohost terms of use [https://cohost.org/rc/content/tos]. As of 2023-Jun-27 they read: > ASSC requires licenses from you for that User Content to operate the Services. By posting User Content on the Services, you grant ASSC a royalty-free, perpetual, irrevocable, non-exclusive, sublicensable, worldwide license to use, reproduce, distribute, perform, publicly display or prepare derivative works of your User Content. In this post, I will overview the comparable TOS provisions for other Cohost-like social sites. What I will argue is all comparable social IP terms either are much more limited in scope than Cohost's, or are expansive in the same way as Cohost's but contain a termination provision where a user can choose to discontinue the IP license in extreme circumstances. (There is one exception— Twitter— and I will argue that the Twitter IP provisions are also a serious problem.) I will also briefly cover Cohost's responses so far when I have contacted them about this. I do not think there is anything you need to be worried about right now. I view this as a long-term problem. ---------------------------------------- WHY IS THIS HERE? > ASSC requires licenses from you for that User Content to operate the Services. It's generally understood online services that rehost user content need not only a copyright license to the content but a license with very broad terms. These services can, over time, change their format or be accessed in new ways, and user content is usually transformed in the act of storing or displaying it, so the license needs to be able to accommodate future technical changes. Ordinary, non-malicious processes like logging or offsite backup can create situations where copies of the user content is retained in places where it can legitimately be difficult to delete. If the site has a share function, users have reasonable expectations that they can use the share function without opening themselves up to legal risk or arbitrary content deletion. However, it does not follow that the license needs to be entirely unlimited. HOW DO COHOST'S IP TERMS COMPARE TO OTHER SITES? You can basically divide social media sites into three buckets: CATEGORY 1: SITES WITH NARROWLY-TAILORED IP PROVISIONS Tumblr has a basically unique IP provision in its TOS [https://www.tumblr.com/policy/en/terms-of-service#:~:text=Your%20Rights%20in%20User%20Content%3A] which gives itself a "non-exclusive, worldwide, royalty-free, sublicensable, transferable" license, but then qualifies it significantly (emphasis mine): > The rights you grant in this license are for the limited purposes of allowing Tumblr to operate the Services in accordance with their functionality, improve and promote the Services, and develop new Services. The reference in this license to "creat[ing] derivative works" is not intended to give Tumblr a right to make substantive editorial changes or derivations, but does, for example, enable reblogging… The license is time-unlimited and irrevocable– but unusually, there is a paragraph explaining why²: > Note also that this license to your User Content continues even if you stop using the Services, primarily because of the social nature of Content shared through Tumblr’s Services - when you post something publicly, others may choose to comment on it, making your User Content part of a social conversation that can’t later be erased without retroactively censoring the speech of others. Again I am not a lawyer, but my understanding is that when interpreting a contract, such as a license, courts try hard to identify the mutual understanding both parties would have entered into the contract with. In my understanding, this means that these "explanatory" sections would have real impact if a dispute were to go to court. By qualifying the intent of the grants– as in the "Note also", as in the "limited purposes" passage, and in some other qualifying language above this I didn't quote– Tumblr has created a situation where if they applied the license in a shocking way, a court probably would point to this text to conclude that the license does not permit the novel use. Tumblr's unusual, thoughtful license puts lie to any claims that a social media site must have a totally unbounded license for the site to continue to function. (They also are yet another thing to show that Tumblr had created something really remarkable before the owners started breaking it.) However, reading Tumblr's TOS also shows us how difficult a relatively pro-user license like this one is to create. The IP section here is several times the length of Cohost's. The amount of lawyer time that must have been taken to write all this, to audit each individual word for traps (there is, of course, a reason why licenses and contracts usually do not contain "extraneous" qualifying language like this in the first place), and to (as they have, unusually) rewrite the license in mostly plain English, must have been enormous. You could also maybe, if you thought about it long enough, imagine future evolutions of the site that the userbase would consider beneficial, but that this unusually specific license would restrict Tumblr from implementing with existing content. That's the tradeoff that Tumblr chose to make. CATEGORY 2: SITES WITH TERMINATION PROVISIONS So Tumblr's license represents the ideal we'd like to see as users. However, there's another way to protect the users without scaring the lawyers: Allow the users to withdraw their IP grant, for example by deleting the content. YouTube's license [https://www.youtube.com/t/terms#27dc3bf5d9] is broad³, but it also has this provision: > Duration of License > > The licenses granted by you continue for a commercially reasonable period of time after you remove or delete your Content from the Service. You understand and agree, however, that YouTube may retain, but not display, distribute, or perform, server copies of your videos that have been removed or deleted. Facebook's TOS [https://www.facebook.com/terms.php] (see "3. The permissions you give us") ends its license with: > This license will end when your content is deleted from our systems. It then spends eleven paragraphs detailing exactly how long it takes to delete content following a deletion request (no quicker than 30 days and no later than 90 days) and listing the precise carveouts (all narrow⁴ and honestly generally reasonable) which might cause a deletion to be delayed past the 90-day window. (Instagram's TOS does not have the same license word for word but per my read it is, in this respect, identical in content.) (Something you will notice in both these cases is how the licenses deal with the practical difficulties associated with rights that terminate on content deletion: they write those difficulties into the license. The "commercially reasonable" language in YouTube's license duration clause is broad enough you could drive a truck through it from an ops perspective, but it would prevent, or could give a court the means to prevent, any actually inappropriate behavior such as post-deletion commercial exploitation of the content.) Termination provisions protect the user imperfectly, because they require the user to take a drastic step (remove the content) which economic or social pressure might make difficult for them. However, critically these provisions protect the user in the case of worst-case scenarios. Although I don't have an example of such⁵, let's consider a hypothetical website where the only way to terminate the IP license is to delete your account. Under normal circumstances, no one would take that step. But under normal circumstances no one would ever care about website IP licenses anyway. If we're worried about IP terms at all, we're worried about drastic and abnormal applications of those IP terms, like selling T-shirts with your art on them and not paying you. Generally those are steps that we can only imagine happening in a weird period when a site is being wound down (because if attempted on a going-concern site it would damage trust with, and drive away, users) and so under these circumstances the cost to the user of invoking the termination clause is low. CATEGORY 3: TWITTER Twitter is the one proper peer to Cohost whose license terms (see 3. Content on the Services [https://twitter.com/en/tos]) are both unlimited in scope and non-revocable⁶. However Twitter also provides a great cautionary tale for why unlimited user content licenses are dangerous. Consider: * As you may have heard, last year Twitter was purchased by new management and is now under total control by one single man, who has begun to act in a manner which is deeply erratic, does not appear to live up to what few values [https://www.independent.co.uk/voices/elon-musk-cisgender-slur-b2362171.html] the previous owners had, and violates established norms for running social sites [https://www.theverge.com/2023/1/22/23564460/twitter-third-party-apps-history-contributions]. It is entirely plausible he could do something freakish and self-destructive with the IP licenses he holds. * Even before Muskification, Twitter is the one social media site I am aware of that has actually abused its broad IP license. I cannot find a cite for what I'm about to say, so you're just going to have to decide whether to believe or not believe my memory: At a certain point in the mid-10s, Twitter ran an ad campaign where they put noteworthy or memorable tweets on billboards. They didn't ask permission from the people whose tweets were featured (as their license allows). I saw one tweet from a person who had been an early BLM activist saying she found out about this only when she saw her own tweets on a billboard; she said she was bothered by this and would not have agreed to the tweet's inclusion if she had been asked, because— even aside from the matter of unpaid commercial exploitation of her words︎!— the billboard implied she endorses Twitter as a business and she does not. In short, the example of Twitter shows that concerns about overbroad IP licenses are not hypothetical, and that there is both precedent for a company using UGC for unpaid commercial exploitation and not getting in trouble for it, and precedent for the idea that UGC licenses existing as a transferrable asset (which can then be sold to an untrustworthy party) is dangerous. For completeness: Although I claimed above that Twitter was unique, now that I am reaching this point in the post it is occurring to me to realize that I didn't think to check TikTok⁸. Although again I must stress that I am not a lawyer, reviewing TikTok's terms of service [https://www.tiktok.com/legal/page/row/terms-of-service/en] now (sections 6 and 7), I would summarize TikTok's IP assignment provisions as "holy cow, this is fucking awful" and "I didn't even imagine it was possible to be this bad"⁹ and based on what I have learned in the last five and a half minutes I would recommend you never post any kind of musical, filmic or artistic works or performances on TikTok, ever. Mastodon doesn't really seem to have any defined IP provisions¹⁰. WHY IS THIS A PROBLEM FOR COHOST? I am on Cohost because I trust its operators. As I've described above, I think the primary reason users should want a limited/revokable IP license is for the extreme, "rug pull" scenarios where the operators suddenly say screw you and start selling your posts in a book or your art on a t-shirt. Nobody could possibly think the current operators would allow that to happen. However, the operators of Cohost, no matter how much I trust them individually, cannot guarantee to us what will happen in the very long term and in particular cannot guarantee they will remain the operators of ASSC indefinitely. Most startups fail. ASSC describes themselves as "a not-for-profit software company" on their website [https://antisoftware.club/], but (I will apologize and retract this if this is incorrect) looking on the State of Washington corporate entities registry, what I find is that legally ASSC is an ordinary for-profit LLC¹². This means the company could be bought and sold in its entirely as an ordinary asset. ASSC has stated that when seeking funding they use their code as collateral for loans, and so far seem to have made a serious effort to protect the autonomy of the site, company, and user-related assets when taking on debt or other obligations; based on this, I would assume that in an unfortunate scenario where Cohost had to be intentionally wound down, ASSC would ensure something responsible happened with the User Content licenses it was hanging on to. But there are other, less orderly scenarios where the company could get wound down unintentionally. For one example, if a lawsuit judgement bankrupted the company all at once it might be a court who decides the disposition of Cohost's assets, not ASSC. Future growth could (should, based on how ASSC has described the cooperative-like nature of its operating articles) dilute the ownership of the original founders, potentially until a majority of shareholders (employees) feel comfortable selling the company in toto. None of this is likely, and again, since the current site leadership is trustworthy on this, this is a long term concern only. However, the long term does exist, and I believe the best way to protect the userbase from an unlikely bad end is protections in the IP license itself (which would by nature survive a change of control). WHAT IS COHOST'S (ASSC'S) POSITION ON THIS? I've publicly asked ASSC about this twice, once after the 2022-Nov-11 TOS changes [https://cohost.org/staff/post/313471-terms-of-use-changes#comment-7f87bbf1-95e6-4490-bb5a-a5c87af9014c] and once after the 2023-Jun-6 community guidelines changes [https://cohost.org/staff/post/1624196-community-guidelines#comment-b7d93d32-3524-4639-903c-361995a4a827]. This second post got a response from @kaara (ASSC's community manager, as I understand): > there's an extreme amount of legal thorns in this and its not something we can touch without working really closely with a lawyer, yeah. Thanks for reminding. My reply: > I can understand that's definitely the case! However I'm going to continue to bring this issue up periodically (in the least disruptive terms I can practically manage…). @kaara's reply: > fair enough! for transparency, getting a ToS revision is not in the short term works right now. I apologize, but I want to be transparent about that fact. For completeness, my reply: > Understood, thank you for the response @kaara: > feel free to remind us every now and then though, thats totally okay. ASSC is right that this is not trivial (and, legal-wise, probably not cheap) to fix. I don't expect this to get fixed right this second and I understand there's been more urgent stuff for ASSC to do, even solely considering the work category of TOS changes. I'm not trying to create suspicion or conflict here. I'm not going to change my behavior over these concerns and I don't think you should either. But in the medium to long term, I do believe this needs to be fixed. ---------------------------------------- ¹ Usually this happens when something *unrelated* changes in the TOS; people go to see what changed, notice the IP terms for the first time and run off to warn everyone about the IP terms in the "new TOS" even though it's the same IP terms as before. But I digress ² An interesting technical difference between Tumblr and Cohost is relevant here: On Tumblr (if I'm not mistaken?) reblogs are implemented with text physically copied into the quote-reblog, whereas on Cohost a rechost seems to be somehow embedding a reference to the original post, such that if the original post is edited or deleted the changes automatically apply to all rechosts. This means as a matter of practical necessity, the Tumblr reblog feature must retain irrevocable licensing for the user-quoted IP, whereas Cohost would have a choice whether to do it this way or not. Of course if a license says, when other users quote posts on the site, their license to do so is irrevocable, this could be construed as itself pro-user; in this case the provider is just making a decision which of two groups of users to favor the interests of. ³ Although to my read it might not be as broad as it could be? Rather than being worded as an unlimited right YouTube grants itself it's rights "in connection with the Service and YouTube’s (and its successors' and Affiliates') business". I guess it seems like "in connection with the Service" limits YouTube's rights in the way you want them to be limited, and then "and its successors and affiliated" blows them back up to being entirely unlimited again. As I am not a lawyer, it seems safest to assume there are no limits on how Google can commercially exploit your YouTube content outside YouTube without compensation. (Although the YouTube Partner Program agreement might of course place additional contractual obligations on Google, if you're part of that.) ⁴ I'm assuming that the more text these license terms have the better for the user, because the more precisely Facebook defines what they're allowed to do the more precisely they're confining their own future behavior. However because they do define quite a few different conditions by which the license can survive deletion, it might turn out one of these clauses is "elastic" and would in practice let Facebook keep its claws in your IP forever. My non-lawyer's assumption though is that this is not a problem because a court would probably not look kindly on, say, Facebook keeping a piece of content undeleted solely because it's involved in a court case, and then turning around and using this legally-dubious content in an ad because technically the license says that's allowed. My assumption is the most dangerous survival clause here is "where your content has been used by others in accordance with this license and they have not deleted it", but this clause could probably not be stretched to permit Facebook itself to use content in a novel commercial way— and as said above, this kind of clause is in some sense pro-user anyway. ⁵ Unless Twitter counts— see below. ⁶ Wait. Is Twitter's IP license revocable? As repeatedly mentioned I am not a lawyer, and I find the wording in Twitter's TOS very confusing. Twitter's IP license does not contain the magic word "nonrevokable" and there is a section headered "Ending These Terms" at the end that says: "You may end your legal agreement with us at any time by deactivating your accounts and discontinuing your use of the Services". Well there you are then, right? There's a termination clause and all you have to do is delete your account. But then there's this next paragraph, which I'm gonna quote in full (as with all quotes in this post, accessed 2023-Jun-27) because it confuses me: > We may suspend or terminate your account or cease providing you with all or part of the Services at any time for any or no reason, including, but not limited to, if we reasonably believe: (i) you have violated these Terms or the Twitter Rules and Policies or Periscope Community Guidelines, (ii) you create risk or possible legal exposure for us; (iii) your account should be removed due to unlawful conduct, (iv) your account should be removed due to prolonged inactivity; or (v) our provision of the Services to you is no longer commercially viable. We will make reasonable efforts to notify you by the email address associated with your account or the next time you attempt to access your account, depending on the circumstances. In all such cases, the Terms shall terminate, including, without limitation, your license to use the Services, except that the following sections shall continue to apply: 2, 3, 5, and 6. If you believe your account was terminated in error you can file an appeal following the steps found in our Help Center (https://help.twitter.com/forms/general?subtopic=suspended [https://help.twitter.com/forms/general?subtopic=suspended]). For the avoidance of doubt, these Terms survive the deactivation or termination of your account. Wait. What? I see two ways to interpret this and neither are great. * Best case scenario: "such" refers to the current paragraph, IE, Twitter terminating your account from their end. So what this means is if you intentionally terminate your account Twitter's IP license is terminated, but if Twitter terminates your account then section 3, which gives Twitter very broad commercial exploitation rights, survives. If this is the case, and this is the best case scenario, this means every user on Twitter has a doom timer where their ability to withdraw Elon Musk from having an unlimited royalty-free license to their work lasts only until Twitter decides to ban them. Moreover Twitter could if it chose decide to ban someone specifically to lock in its license to that person's work, and it even has an enumerated right to activate this clause because the service is not "commercially viable". In other words, tomorrow Musk could declare that Twitter is out of money, shut down the entire site with no warning, and replace it with a store where you can buy commemorative prints, artbooks, t-shirts and NFTs of famous Twitter posts, and if he did it this way he wouldn't have to pay anyone a cent in royalties. Can you look me in the eye and say this is not something Elon Musk would do? * Worst case scenario: Is there wiggle room in the meaning of the single word "such" (IE, would a court understand "such" to refer to the current paragraph, or the current section)? What does "For the avoidance of doubt, these Terms survive the deactivation or termination of your account" mean? Is it reiterating section 3 endures in the case of a ban? Is it reiterating that the "if we ban you, we own you" clause survives a Twitter-initiated account termination? Or is it saying sections 2, 3, 5 and 6 survive deactivation or termination of your account flat out, which would mean they survive even if you deleted the account yourself? Alternately, does this clause create a bizarre catch-22 where Twitter retains the right to fire you even after you quit— IE, you delete your account terminating section 3, then after you delete your account Twitter bans you and the ban reactivates section 3? I literally don't understand! Possibly a lawyer would think this is all very clear but to my eye this looks ambiguous and ambiguity is the worst thing in a contract, because it has the potential to create disputes that can only be resolved by going to court (in this case, against the world's richest⁷ man). Conclusion: If this is a termination clause, it isn't a good one. ⁷ According to Forbes right at the second I'm writing this. ⁸ Arguably not actually a peer site to Cohost… but, well, by that argument I guess neither would be YouTube. ⁹ Most of the licenses quoted in this post are unlimited in scope, and I assume a court would therefore find them to extend to uncompensated commercial exploitation. Some of the licenses, such as Twitter's, take the step of explicitly saying they can commercially exploit your work without compensation, which would reduce your options in court. But then check out this entirely unique clause in the TikTok license: > For the avoidance of doubt, the rights granted in the preceding paragraphs of this Section include, but are not limited to, the right to reproduce sound recordings (and make mechanical reproductions of the musical works embodied in such sound recordings), and publicly perform and communicate to the public sound recordings (and the musical works embodied therein), all on a royalty-free basis. This means that you are granting us the right to use your User Content without the obligation to pay royalties to any third party, including, but not limited to, a sound recording copyright owner (e.g., a record label), a musical work copyright owner (e.g., a music publisher), a performing rights organization (e.g., ASCAP, BMI, SESAC, etc.) (a “PRO”), a sound recording PRO (e.g., SoundExchange), any unions or guilds, and engineers, producers or other royalty participants involved in the creation of User Content. Holy crap! In part this clause seems reasonable (in the latter section they want to be totally clear that if you are a musician and you post to TikTok, that you're not devolving your own financial obligations to ASCAP etc onto TikTok), but in the other part, they are explicitly granting themselves the right to take musical performances you upload to TikTok, put it on a CD, and sell it without paying you. They're just outright saying it! I think the word "mechanical" here might be necessary even for the specific case of streaming— which is something TikTok needs to do on a mass scale, so that makes this a little less menacing— but nobody forced them to use the word "mechanical" and not qualify it. This isn't a contract clause, it's a threat! ¹⁰ This footnote was edited a couple hours after the original post went up¹¹. If you look at the Mastodon.social TOS [https://mastodon.social/about] you'll find it's extremely short and has no IP license terms whatsoever. Nothing relevant is in the privacy policy [https://mastodon.social/privacy-policy] either. So apparently Mastodon just is operating… in no defined copyright regime at all. This is actually very surprising to me. I guess at some level I realized that the entire point of the Fediverse is servers mirroring posts between each other, and that there wasn't any specific legal framework that defined when and why people are allowed to do that mirroring, but Mastodon gGmbH (parent company of mastodon.social) does things in a much more organized way than most of the Fediverse and so I'm very surprised Mastodon gGmbH's servers don't, for example, require posters to give Mastodon gGmbH permission to post the posts, or require posters to make a representation to Mastodon gGmbH that they have the legal right to post the things they're posting. Either Mastodon gGmbH is blowing a hole here in the conventional wisdom that you can't legally operate a UGC website without getting these permissions, or else they are setting a very ugly future trap for themselves. (Or maybe they manage to fall into some legally blessed area due to either the fact that they are legally a nonprofit or due to the fact they are incorporated in Germany. But I doubt this.) ¹¹ Full disclosure: Originally, this footnote was much more confused and was marred by me getting mixed up between the TOS of Mastodon proper and the TOS of the now-defunct Mastodon gGmbH support forum. Since that support forum is now offline, I was not able to find the TOS terms I previously remembered reading, and expressed confusion about whether something had changed. Nothing changed, the support forum was a different website. This is an embarrassing mistake even for a footnote and I apologize. Anyway you can confirm the absence of a specific IP provision in the mastodon.social TOS as far back as 2017 [https://web.archive.org/web/20171206215818/https://mastodon.social/about/more] using archive.org. ¹² My own research indicates that United States law actually generally sucks for your options when starting a co-op or public-benefit corporation, so I assume ASSC is making a best effort to approximate a cooperative not-for-profit using corporate articles or policies or whatever. If they told me they looked into their options and this was actually the best one, I would believe them. However, their legal status does I believe expand the set of possible long-term ends for the company.

web.archive.org · andi on cohost