What the clients were told¶

That they were getting security hardening, container scanning, and incident response exercises. This is accurate. It is not complete, which is a distinction the legal profession charges considerably more than the MCLU does to explain.

The client agreement runs to nineteen pages in the standard edition, twenty-three in the enterprise version, the additional four consisting primarily of indemnification clauses in a font size our legal volunteer describes as “aspirational.” We have read all of it. This is the kind of service the MCLU provides, and the reason we have no money.

Within those pages: the provider may use monitoring tools for service quality and security, may share data with “trusted partners” for operational purposes, and may update these terms with fourteen days’ notice delivered by a method of the provider’s choosing. Nowhere does it specify who the trusted partners are, or what operational purposes encompass, or whether a carrier pigeon to a previous address counts as notice. The MCLU would like these questions answered. We expect to be disappointed.

Terms of service of this kind are not written to be understood. They are written to have been agreed to. The distinction is where most of the interesting legal questions about digital consent currently live, and the MCLU has been attempting to move those questions into courtrooms for long enough to have strong opinions about the seating.

Whether this constitutes adequate disclosure¶

No.

The MCLU is rarely this brief. We feel the situation warrants it.