UPDATE:
Terms of Service are now finalized and located at https://www.drupal.org/terms.
Privacy Policy is now finalized and located at https://www.drupal.org/privacy


Almost half a year ago, with the help of the Drupal.org Content Working Group and lawyers, the Drupal Association started working on a Drupal.org Terms of Service (ToS) and Privacy Policy. After a number of drafts and rewrites, we are now ready to introduce both documents to Drupal.org users.

Why do we need a ToS?

Drupal.org has grown organically for many years. Currently the site has thousands of active users that generate lots of content every day. Our current Terms of Service are limited to a short line on the account creation form:

“Please note: All user accounts are for individuals. Accounts created for more than one user or those using anonymous mail services will be blocked when discovered.”

This line is an insufficient ToS for a website of our size. In fact, Drupal.org is probably the only website of this size which operates without a published Terms of Service. This situation is uncomfortable, and even dangerous, for both Drupal community and the Drupal Association, which is legally responsible for Drupal.org and its contents.

In the absence of a ToS, a lot of rules—“do’s and don’ts”—regarding the website are just “common knowledge” of users who have a long memory and accounts created in the early days of Drupal.org. This might result in new users making mistakes and misbehaving only because they do not know what the unwritten rules are. Website moderators often lack guidance on how to react in specific situations, because those policies are not written anywhere. Some policies, such as organization accounts policy or account deletion policy still need to be defined. Lastly, absence of clearly defined Terms of Service and Privacy Policy could lead to legal disputes regarding the site.

What’s next?

The new Drupal.org Terms of Service and Privacy Policy are published now for the community review. We'll continue refining them based on community feedback and announce the 'official' implementation day additionally. On that day all existing users will have to accept these ToS and Privacy Policy to continue using the website. All new users starting on that day will have to accept the ToS and Privacy Policy upon account creation.

Click to review Drupal.org Terms of Service

Click to review Drupal.org Privacy Policy

In the future, we will make sure to keep ToS and Privacy Policy up-to-date and update them every time policies or functionality of the website changes. We will proactively notify users of all modifications to both documents.

Thanks

We’d like to say thanks to the Drupal.org Content Working Group members and community members who already reviewed proposed documents and provided us with their valuable feedback.


UPDATE: Edits to the original drafts were made on 21st of August, 2014, based on feedback in comments to this post.

UPDATE #2 (03.09.2014): We are postponing ToS/PP official launch and will come back with an updated draft shortly.

Comments

tvn’s picture

I don't think that anyone will be blocked by posting a comment or part of it in another language. However what if someone starts posting comment after comment after comment in a language most users don't understand? What if they do it in the core issue?

Another specific example we were trying to address is when users post case study or organization node or project page in a different language, we (webmasters) ask them to translate it into English. If they don't do it, the node gets unpublished after some time. We wanted this to be clearly documented to give webmasters 'official' page they can point to and explain their request.

Can we change the wording somehow to make it clear that no one will be blocked in your example, but allow us to take an action in other cases? E.g.:

The language of the site is English. The content you publish will be written in English (except for local user groups at groups.drupal.org and programming languages, of course). If you publish a node in a different language, we will ask you to translate it, otherwise it might be unpublished. If you repeatedly post content in a language other than English, you might be blocked.

C-Logemann’s picture

I think this focus on english is OK for drupal.org especially if there is no risk of banning users when they use another language. But the TOS is for *.drupal.org and so also groups.drupal.org is influenced. There we can choose a different "Group language" which is used by lot's of local communities.For this groups there is maybe a need for asking users to not use a language different from group language even if english.

--
There is a module for that!
My company: Nodegard GmbH

tvn’s picture

That's why we explicitly say "The content you publish will be written in English (except for local user groups at groups.drupal.org..)".

C-Logemann’s picture

That's why we explicitly say "The content you publish will be written in English (except for local user groups at groups.drupal.org..)".

You are right. I didn't noticed that you already implemented this important exception.

I agree that it's good to have some rules where our webmasters can work with. I want to thank everyone who is working on the new TOS. But I believe there is still a lot of work for reviewing and discussion.

--
There is a module for that!
My company: Nodegard GmbH

Xano’s picture

This is an issue about the difference between drupal.org's legal terms and house rules. If you're in my house and you're being annoying, I can throw you out, but not sue you. That distinction must be clear in the ToS.

catch’s picture

However what if someone starts posting comment after comment after comment in a language most users don't understand? What if they do it in the core issue?

An on-topic comment in a language other than English isn't worse than an off-topic (and/or unintelligible) comment in English - and there are many, many more of that latter in the issue queue - both core and contrib. The response I see most often to those is unpublishing the comment.

The unpublishing of case studies with no translation (after a request for translation was ignored, and presumably also time passing) is fine with me - but that's a content moderation decision - does the TOS really need to cover specifics of case studies?

I agree that someone posting lots of comments not in English in the core queue might be a problem, but it doesn't feel like a real problem that needs to be covered specifically by the TOS.

gaele’s picture

From C.2:

[...] we have the right to fully cooperate with any law enforcement authorities or court order requesting or directing us to disclose the identity of anyone posting any materials on or through the Website. (emphasis mine)

Are you going to use that right on every law enforcement request? E.g. from the authorities in China? Egypt?

greggles’s picture

Of course not. This is the kind of non-constructive comment we've seen on this thread that really frustrates me. You have a very valid complaint, but you phrase it in a way that's critical and not constructive and seems a bit frustrated. If you start from a position of criticism and frustration it makes it harder for people to collaborate in finding a solution.

Consider an alternate approach, making a specific, reasonable request that addresses your concerns. For example:

I think it would be great for the DA to create a page like this:

http://www.google.com/transparencyreport/removals/government/

My guess is that it would currently list zero incidents and probably would remain blank for a long time into the future. But having a page like that which details what information you will share when a government request does come in AND a commitment to keep it up to date that will help give comfort to a lot of people (including me).

gaele’s picture

Hi greggles, yes a lot of the people in this threat are frustrated. First I wanted to say sorry for making you frustrated too, but then I thought maybe it's a good thing you feel like we feel for a moment :-)

What's really annoying me is the feeling I get from this that the DA is acting like a corporation, or worse yet a US corporation, copy pasting a corporate ToS, instead of an association working in the interest of the community. jbrauer and Xano already worded it better than I can.

To solve this it won't help tackling the issues raised here one by one. First the attitude needs to change. So I welcome the postponement of the ToS.

Regarding my issue above, I think your proposal would be a move in the right direction. What I would really like though is for the DA to take a stance ("What we won't do ....").

killes@www.drop.org’s picture

Q: What's 200 lawyers chained to the bottom of the sea?

A: A good start.

Anonymous’s picture

With README files and other in-repo non-code documentation, are those considered "user generated content" or "code" for licensing purposes considering that CC-BY-SA is incompatible with GPL?

gaele’s picture

gisle’s picture

gaele wrote:

All files in Git are GPL.

Only in the dreams of those that created this ToS. In reality, a lot of exceptions are tolerated and/or requested.

And because of fiction that "All files in Git are GPL", there is not even a requirement to properly document these exceptions, which means that today, there is considerable confusion about what license a given file is under.

For instance, there are almost no non-code assets (fonts, icons, images) available under GPL. This is because GPL is a very, very poor license for assets. So free (as in "freedom") assets are instead made available under non-GPL compatible licenses such as the SIL OFL or CC BY-SA. In 2014, people bundle assets with their projects. And if you look at the files that is in the Drupal.org git repo, you'll see that a lot of these non-GPL assets are present in the repo.

There is a separate discussion about this going on. Hopefully, it will redefine Drupal.org's policy on hosting 3rd party files and/or files that is not strictly GPL. There si no conclusion yet, but one possible outcome is Git repo policy and licensing FAQ may change into something more in tune with the current practice.

There is also another discussion to render the README.md for a project on the Drupal.org project page.

While this proposal makes a lot of sense from a practical and technical perspective, it does not fit well with the "All files in Git are GPL" dictum, since posting it on the project page will bring it under CC BY-SA 2.0, which is incompatible with GPL.

- gisle

chx’s picture

The Website, its features and functionality are owned by the Drupal Association.

You do realize, of course, that the website runs GPL software and as such the functionality is most definitely not owned by anyone except perhaps a mass of Drupal contributors?

The content you publish will not contain any material which is defamatory, obscene, indecent, abusive, offensive, harassing, violent, hateful, inflammatory or otherwise objectionable.

Offensive to whom? Objectionable by whom?

The language of the site is English. The content you publish will be written in English

You are kidding me, right? Are you seriously going to ban someone for posting a question in their native language and/or answering to that?

Use the Website in any way that violates any applicable law or regulation (including, without limitation, any laws regarding the export of data or software to and from the US or other countries);

Wait, did just ask me to know the software export regulations of every country in the world?

Use the Website in any manner that could disable, overburden, damage, or impair the Website

So when I put my name as <script>alert('chx');</script> to the DrupalCon Coppenhagen site that is a bannable offense?

All disputes relating to these Terms or any aspect of the Website will be resolved by binding arbitration

Did you just try avoiding anyone suing you? Isn't this sort of thing considered evil?

This Website is not intended for children under 13 years of age

That is unacceptable. We will not post such a thing to drupal.org . We had most excellent contributors below the age of 13. Edit: COPPA applies only to commercial entities, not non-profits or schools.

We may disclose information we collect from or about you when we believe disclosure is appropriate to protect the safety of the Association

That is not even funny.

If some or all of our business assets are sold or transferred as a result of any corporate change (merger, consolidation, reorganization, bankruptcy, etc.),

WTF.

Nothing in this Privacy Policy is intended to interfere with our ability to transfer all or part of this Website) to an unaffiliated third party at any time, for any purpose, without any limitation, and without notice or any compensation to you.

You are kidding me, right? You just said that you can do whatever the hell you want with the data.

--
Drupal development: making the world better, one patch at a time. | A bedroom without a teddy is like a face without a smile.

Jaypan’s picture

You do realize, of course, that the website runs GPL software and as such the functionality is most definitely not owned by anyone except perhaps a mass of Drupal contributors?

I believe this is incorrect. People can still own sites, all Drupal sites are not owned by all contributors.

catch’s picture

While you can own the site, you can't claim ownership of all of the functionality on the site.

chx’s picture

We welcome community members of any age, however due to legal requirements, if you are under 13 year old, you will need to use the site with your parents.

WHAT legal requirement? I call BS because neither Mozilla https://www.mozilla.org/en-US/about/legal/ nor Wikipedia https://wikimediafoundation.org/wiki/Terms_of_Use restricts kids.

--
Drupal development: making the world better, one patch at a time. | A bedroom without a teddy is like a face without a smile.

chx’s picture

Speaking of, can we just take Mozilla's ToS, replace the "3. Changes" with one that tells you we will warn and be done with this sad farce?

--
Drupal development: making the world better, one patch at a time. | A bedroom without a teddy is like a face without a smile.

ar-jan’s picture

+1 to this. There are too many provisions that require the community to completely and unconditionally trust that the DA would never, ever, make any unreasonable decision.

Xano’s picture

The original news article makes it sound drupal.org needs Terms of Service because day-to-day administration needs to become more consistent. It also asks drupal.org users and not lawyers for feedback. The draft document, however, is full of legal conditions and does not sound like it tries to help in the aforementioned day-to-day administration of drupal.org. Instead, it sounds formal, sometimes somewhat scary, and overall like its purpose is to protect the DA from being sued.

While I understand that a legal entity wants and needs to protect itself, considering what the Drupal community is, I think we can and must do better. As mentioned before by at least @chx and me, scaring (young) people away is the last thing the DA should be doing.

The original article also says the ToS will come into effect tomorrow, on Thursday September 4th. So far only one revision has been made based on community feedback. Will the ToS really be forced upon us tomorrow, without taking into account all the more recent feedback that is partly based on the revision of August 21st?

greggles’s picture

+1 to postponing.

I really think that this deployment/enforcement should be postponed. It's going to take more time to make a ToS we can be proud to have on our lovely sites.

tvn’s picture

Hi all,

based on all the feedback we decided to postpone ToS implementation, so nothing will happen tomorrow, 4th of September. We'll come back with an updated draft shortly.

chx’s picture

No more drafts. Unless you pull a Road To Damascus (which admittedly the DCOC draft did) it will be way too little.

Instead, let me repeat: just use Mozilla's. (Possibly with an upgrade that we warn about changes)

--
Drupal development: making the world better, one patch at a time. | A bedroom without a teddy is like a face without a smile.

Jaypan’s picture

Be realistic. It's doubtful that they are going to suddenly abandon all efforts up until now and suddenly go a different direction altogether. Efforts are better focused on providing constructive feedback on the current TOC draft, than trying to point in another direction altogether, or providing feedback in a manner that alienates the people who are working hard to try to put something together. Particularly when this is a task that likely none of them have previous experience in, and when there likely isn't anyone available who does.

chx’s picture

this is a task that likely none of them have previous experience in

Then just let's pick Mozilla's...

--
Drupal development: making the world better, one patch at a time. | A bedroom without a teddy is like a face without a smile.

greggles’s picture

Mozillas is also rather long and has all caps in it, two major complaints about the DA version. I don't see why you feel it's a panacea.

I also don't see why you think drafts are not a way to solve problems. If this were a patch file in an issue would you be happier? We do dozens of drafts of patches. Why not for the TOS as well?

chx’s picture

I would reset the issue to active and ask for a rewrite from ground up. Whoever wrote this has zero connection / knowledge of Drupal, the software, the community and the website. I have little faith that the next draft would be a complete reboot (but then again, the DCOC draft was).

I see the Mozilla one as a panacea because the all caps is a minor problem and 1) it doesn't try to appropriate all content, data and functionality, violating existing licenses in place 2) it doesn't put any restriction on kids 3) doesn't try to avoid lawsuits consequences be damned. And, we don't need to spend a gazillion dollars on lawyers to verify its legalese.

--
Drupal development: making the world better, one patch at a time. | A bedroom without a teddy is like a face without a smile.

Pages