Windows 10 Eula Privacy Rights Many are claiming that Windows 10's data collection is much more invasive than previous Microsoft products, even claiming that Windows 10 ships with a keylogger and reports every keystroke back to Microsoft. Most locally, this question on the Stack Exchange network makes some of the same claims. However, it seems that many of those sources have conflated the developer pre-release version of Windows 10 with the official release, and I'm having trouble separating the wheat from the chaff. My goal in asking this question is to look past the sensationalist reporting and see what rights Microsoft holds. The official End-User License Agreement for the final retail release of Windows 10 says the following: Privacy; Consent to Use of Data. Your privacy is important to us. Some of the software features send or receive information when using those features. Many of these features can be switched off in the user interface, or you can choose not to use them. By accepting this agreement and using the software you agree that Microsoft may collect, use, and disclose the information as described in the Microsoft Privacy Statement (aka.ms/privacy), and as may be described in the user interface associated with the software features. The referenced Microsoft Privacy Statement says the following: Microsoft collects data to operate effectively and provide you the best experiences with our services. [...] We get some of it by recording how you interact with our services by, for example, using technologies like cookies, and receiving error reports or usage data from software running on your device. We also obtain data from third parties (including other companies). Microsoft uses the data we collect to provide you the services we offer, which includes using data to improve and personalize your experiences. [...] We use data to help make the ads we show you more relevant to you. However, we do not use what you say in email, chat, video calls or voice mail, or your documents, photos or other personal files to target ads to you. Windows 10 (&quot;Windows&quot;) is a personalized computing environment that enables you to seamlessly roam and access services, preferences and content across your computing devices from phones to tablets to the Surface Hub. Rather than residing as a static software program on your device, key components of Windows are cloud-based, and both cloud and local elements of Windows are updated regularly, providing you with the latest improvements and features. In order to provide this computing experience, we collect data about you, your device, and the way you use Windows. And because Windows is personal to you, we give you choices about the personal data we collect and how we use it. Putting aside the technical question of what information the software actually does collect (which would be off topic)... From a legal standpoint, in the retail version of Windows 10: How does Microsoft's claim to user data differ from previous versions of Windows? Does Microsoft have the right to record arbitrary keystrokes or clicks made while using their operating system and send that data to external servers? Does Microsoft have the right to share user usage data with third parties (such as advertising agencies), either at a price or without compensation? Despite saying that they currently don't use data directly from our personal files for this purpose, do they have a right to begin doing so at any time?
(2019 update See comments for my exchange with @benrg updating this 2015 answer. In particular, they do a fair job of representing a much less &quot;paranoid&quot; take on MS's take on users' privacy than my highly skeptical one. Also, the links in the answer below are to the latest versions of the respective documents. Archive.org has 2015 versions at 2015 EULA and 2105 privacy statement.) IANAL. This answer is just a broad picture. It's a simple explanation of Microsoft's own words, as they were at the time of originally writing this (just after the final release of Windows 10). TL;DR: Microsoft does not recognize users' privacy rights. The Microsoft Privacy document does not say anything positive about privacy in this document that isn't contradicted by their own words elsewhere in the same document. Microsoft does explicitly reserve rights to share users' private data with just about anyone and everyone. Microsoft explicitly disallows legal recourse regarding privacy. The Windows 10 EULA comprehensively denies legal recourse related to privacy (and indeed anything other than IP disputes). It's Microsoft's offerings as a whole, not (just) Windows 10 The key document to focus on is Microsoft's Privacy policy document. This policy applies to many Microsoft products and services, including, but definitely not limited to, Windows 10. Microsoft reserve the right to share your private data Quoting the &quot;Privacy&quot; document, Microsoft reserves the right to share users' private data: among Microsoft-controlled affiliates and subsidiaries with vendors or agents working on our behalf as part of a corporate transaction such as a merger or sale of assets [to] comply with applicable law [to] respond to valid legal process [to] protect our customers, for example to prevent spam [to] operate and maintain the security of our services [to] protect the rights or property of Microsoft as necessary to complete any transaction or provide any service you have requested or authorized Do users have any privacy rights? One can presumably fight for one's (perceived) rights even if Microsoft attempts to deny them. However, from the English Windows 10 EULA: you and we agree to try for 60 days to resolve [a dispute] informally. If we can’t, you and we agree to binding individual arbitration ... and not to sue in court Additionally, collective action or any other form of representative action is explicitly disallowed. Windows 10 data collection defaults to &quot;Full&quot; mode You've said that what data is collected is off topic. But I think it's worth recognizing that, with Windows 10, Microsoft have made the most popular install option collect and send to their cloud all data collected from your local device (&quot;Full&quot; collection) and have effectively made it a breach of contract to reduce it below a minimal level (&quot;Basic&quot; collection) that they get to determine and change as they see fit. And they can pretty much enforce the latter; if you hack a system to stop &quot;Basic&quot; data being sent to MS, they explicitly disable updates for that system.
If you don't want someone copying your stuff you don't need a licence at all - that is the default way copyright works. Simply put a copyright notice in the deployment and any splash screen or about screen.
Disclaimer: Not a lawyer or even living in US. I try to write the answer under US law. Other countries law may differ. Make sure you consult a lawyer in your jurisdiction. Here is my understanding of the individual examples: You don't need permission legally, because you are only accessing your own account and your own information. You are the only one damaged by the intrusion and therefore, nobody can really file a lawsuit against you. This is often used by security researchers when the subjects are uncooperative. That being said, if it is an actual pentesting client, you may want to refrain from it regardless. You don't need a permission to modify hardware you own. This is completely legal and not considered an attack. It would qualify as an upgrade, such as replacing a component in your laptop. You are allowed to do that. You should have a permission here. This is an intentional penetration test and you should have permission to do this. The same as 3. This is an intentional penetration test and you should get a permission. Though if you logout immediately and don't mess with the interface, it may not be illegal on the basis that you did not cause any damage or steal any information, or it may be illegal under some circumstances. It may also be impossible to prove that you did not do anything while there.
You must get opt-in affirmative consent to process personal data, including tracking people's use of your site or providing targeted advertising. The banner on StackExchange is likely in violation of the GDPR. Do not copy it. It does not have an explicit opt-in, only an opt out which is onerous (leave the site, then manually go in and delete any cookies they set, which may be hard to identify if they are from 3rd parties). The sites you mention that have a gateway are a more correct implementation. Consent must be acquired before processing of data begins, and it must be explicit.
You wrote: As far as I believe, it is permitted under GDPR to record and store non-anonymized web server access logs, as these can be useful for security reasons. True, Recital 49 GDPR: The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems. You asked: My question is whether this anonymization process counts as processing personally identifiable data under GDPR? IP addresses are personal data in some cases, so yes, you're processing personal data. Then, these anonymized logs will be fed into an analytics tool to provide stats on unique visitors, page hits, etc. These are purposes considered compatible with initial purposes according to Article 5.1.(b): Personal data shall be (...) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for (...) statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’); As a matter of fact, you might be required to anonymize the data for those purposes, see Article 89.1: Processing for (...) statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. If I were to anonymize the logs and continue to use them exclusively for security reasons, would that change anything? No, you would be processing data in a manner compatible with initial purposes (ensuring network and information security). Or does it not matter what I do with them once they are anonymized? Yes, it does. If you're not using them for &quot;archiving purposes in the public interest, scientific or historical research purposes or statistical purposes&quot; then you're using them for purposes incompatible with initial purposes. You would need to find new legal basis for processing. does this extra anonymization process on top then take it over the line meaning that consent and a privacy notice would be required? It depends on what you want to do with anonymized data. In your case, for security purposes or security and statistical purposes, you don't need the consent and there is no requirement for the privacy notice (but sure, it would be nice to publish one). For other purposes it might be different.
Downloading commercial software without permission would be infringement, unless an exception to copyright (probably fair use in the US) applied. That the maker and copyright owner no longer supports or sells this software would not change that. The first-pass fair use analysis in the question is reasonable, and a court might find this to be fair use, but it is far from assured that it would be so found. US statutory damages could be as high as $150,000 or as low as $750 if Microsoft sued and won. However, as you say, there is no current or plausible future market for Windows 95, and there are lots of copies on CDs and other media floating around, easily available if anyone wanted a copy. I suspect that Microsoft would not choose to take such a matter to court, even if they became aware of it. If Microsoft does not choose to sue, there is no enforcement action by anyone. Of course they could choose to sue, it is their right to sue.
It is legal for a manufacturer to sell a device which is capable of being misused. For example, a wifi-capable router can be sold even if it is &quot;open&quot; by default. A Bluetooth device has a shorter range than wifi, but in principle can connect to any other device. An owner's legal liability is not different given wifi vs. Bluetooth. Whether or not there is criminal liability for a third person who connects to the device also does not specifically depend on whether the device uses Bluetooth technology, as opposed to some other technology. 18 USC 1030 is the general federal law prohibiting &quot;unauthorized access&quot;. In the case of a bed, two legal question arise: is it a &quot;computer&quot;, and is it &quot;protected&quot;? It is an electronic high speed data processing device which performs logical, arithmetic, storage and communications facilities, i.e. it is a computer (in the legal sense). It probably is not protected, because it is not &quot;used in or affecting interstate or foreign commerce or communication&quot;, that is, it is not connected to the internet (unless it is). State laws tend to be broader, not having the &quot;interstate commerce&quot; limitation, so accessing the bed would violate Washington's analog of the federal law. However, under Washington law, the access is probably not &quot;without authorization&quot;. That term is defined as knowingly circumvent technological access barriers to a data system in order to obtain information without the express or implied permission of the owner, where such technological access measures are specifically designed to exclude or prevent unauthorized individuals from obtaining such information, but does not include white hat security research or circumventing a technological measure that does not effectively control access to a computer. The term &quot;without the express or implied permission&quot; does not include access in violation of a duty, agreement, or contractual obligation, such as an acceptable use policy or terms of service agreement, with an internet service provider, internet website, or employer. The term &quot;circumvent technological access barriers&quot; may include unauthorized elevation of privileges, such as allowing a normal user to execute code as administrator, or allowing a remote person without any privileges to run code. One question is whether there is any technological access barrier that the user circumvents (I don't know if it is possible to circumvent &quot;hidden mode&quot;). Since the term &quot;may include ... allowing a remote person without any privileges to run code&quot;, and since playing music on speakers involves running code, then the remote user may be criminally liable. On the third hand, the language of that paragraph (&quot;technological access measures are specifically designed to exclude or prevent unauthorized individuals from obtaining such information, but does not include ... circumventing a technological measure that does not effectively control access to a computer&quot;) clearly indicates a legislative intent to address deliberately overcoming active access barriers and not accidentally connecting to an unprotected, open system. Plus, the law also says that you are accessing the computer &quot;in order to obtain information&quot;, but that is not the purpose of transmitting sound to speakers.
You're misreading the law. You need to keep reading the section you referenced (emphasis added): The disclosure...shall be made in writing and delivered through the consumer’s account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumer’s option if the consumer does not maintain an account with the business Thus, the option to have the disclosure sent by mail only applies to consumers who do not have an account with the business. Since presumably a large number of sites only maintain personal information for users with accounts, such sites need not provide a mail option. Further, it doesn't say there needs to be a button: you just need the ability to say you'd like it mailed to you in the request somehow, and then they need to comply when you do.