eula

# End-User License Agreement (EULA)

Drafts an enforceable EULA protecting licensor IP, limiting liability, and satisfying consumer protection standards across jurisdictions.

## Intake Checklist

Gather before drafting:

1. **Software** — product name, version, deployment model (desktop / mobile / SaaS / cloud / embedded)
2. **License model** — perpetual, subscription, usage-based, freemium, or trial
3. **User population** — B2C, B2B, or mixed; users under 13 (COPPA trigger)
4. **Geography** — US-only, EU, or global (drives GDPR, CCPA applicability)
5. **Data collected** — personal data categories; PHI (HIPAA), financial (GLBA), student (FERPA), payment (PCI-DSS)
6. **Third-party components** — open-source (copyleft vs. permissive) or proprietary
7. **App store** — Apple App Store, Google Play, or direct distribution
8. **Risk posture** — arbitration/class-action waiver? IP indemnification? Benchmark restrictions?

## Drafting Workflow

### 1. Header & Acceptance

- Title: "END-USER LICENSE AGREEMENT" prominently displayed
- Specify triggering act: install / account creation / first use
- Click-wrap required: scrollable full text, accept button active only after scroll opportunity (*ProCD v. Zeidenberg*; avoid browse-wrap per *Specht v. Netscape*)
- Mobile: present in app-store listing + first launch; must not contradict platform terms
- Version date + 30-day advance notice for material amendments; affirmative re-acceptance for paid-tier changes reducing rights

### 2. Definitions

| Term | Scope |
|---|---|
| Software | Product name, version, included modules |
| Updates | Bug fixes / security patches (included) |
| Upgrades | Major versions (may require separate fee) |
| Authorized Users | Named / concurrent / site license scope |
| Documentation | Manuals, API docs, specs |
| Confidential Information | Source code, algorithms, benchmarks, designated materials |

### 3. License Grant

- Non-exclusive, non-transferable, revocable for breach, [perpetual / subscription-term]
- Specify device count or concurrent user cap
- Permitted use: internal business / personal; per Documentation
- One archival backup copy; proprietary notices intact
- SaaS: frame as access right, not installation right
- Trial: evaluation-only, non-production, time-limited with end date; auto-terminates at expiry

### 4. Restrictions

| Category | Prohibited Conduct |
|---|---|
| Reverse engineering | Decompile, disassemble, derive source — except as required by law for interoperability (EU Directive 2009/24/EC) |
| Derivative works | Modify, translate, adapt, or create based on Software |
| Distribution | Sublicense, rent, lease, lend, transfer, service-bureau use |
| Circumvention | Bypass license enforcement, DRM, or security features (17 U.S.C. § 1201 [VERIFY]) |
| Notices | Remove/alter copyright, trademark, or proprietary legends |
| Competitive use | Benchmark for competitive analysis; publish results without consent |
| Safety-critical | Aircraft nav, nuclear, life support, weapons |
| Export | Export/re-export violating EAR, ITAR, or OFAC sanctions |

### 5. IP Ownership

- Licensor retains all rights — copyright, patents, trademarks, trade secrets
- **License, not a sale**; first-sale doctrine inapplicable
- User data: user owns; licensor gets limited processing license for service delivery
- Aggregated/anonymized data: licensor owns derived insights
- Feedback: user assigns all rights; moral rights waived to extent permitted
- Third-party components: designated as intended third-party beneficiaries; confirm no GPL copyleft contamination
- Trademarks: no right to use licensor marks except to identify Software

### 6. Payment & Renewals

- State fees in specific currency (not by reference to pricing page)
- Auto-renewal: conspicuous pre-purchase disclosure per Cal. Bus. & Prof. Code § 17600 et seq. [VERIFY]; easy cancellation; advance renewal reminder
- Non-payment: notice + 5–10 day cure → suspension; 10–15 day cure → termination
- Refunds: state terms explicitly; app-store refunds per platform policy
- Taxes: exclusive of taxes; user bears sales/use/VAT; EU VAT reverse charge for B2B

### 7. Term & Termination

- **For cause**: immediate upon material breach (IP violation, non-payment, export violation, insolvency)
- **Without cause**: free licenses — 30 days notice; paid perpetual — generally not permitted
- **User termination**: cancel per stated procedure; cease use; destroy all copies
- **Post-termination**: uninstall all devices; destroy copies (including backup/cached); written certification on request; SaaS — 30-day data export window then deletion
- **Survival**: IP ownership, restrictions, confidentiality (3–5 years / indefinite for trade secrets), disclaimers, liability caps, indemnification, dispute resolution

### 8. Warranty Disclaimer

> **MUST BE ALL-CAPS OR BOLD (conspicuousness requirement)**

- Limited warranty (if offered): Software substantially conforms to Documentation for [30/60/90] days; excludes modified software, misuse, unauthorized combinations
- Exclusive remedy: patch → replacement → pro-rata refund + termination
- **Disclaimer**: SOFTWARE PROVIDED "AS IS" AND "AS AVAILABLE." LICENSOR DISCLAIMS ALL WARRANTIES — EXPRESS, IMPLIED, STATUTORY — INCLUDING MERCHANTABILITY, FITNESS FOR PARTICULAR PURPOSE, NON-INFRINGEMENT, TITLE, QUIET ENJOYMENT, ACCURACY. NO WARRANTY OF UNINTERRUPTED OR ERROR-FREE OPERATION.
- Savings clause for jurisdictions prohibiting full warranty exclusions
- Magnuson-Moss Warranty Act compliance for consumer products [VERIFY applicability]

### 9. Limitation of Liability

> **MUST BE ALL-CAPS OR BOLD**

- **Consequential damages exclusion**: NO LIABILITY FOR INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, EXEMPLARY, OR PUNITIVE DAMAGES INCLUDING LOST PROFITS, LOST DATA, BUSINESS INTERRUPTION, REGARDLESS OF CAUSE OR FORESEEABILITY.
- **Aggregate cap**: fees paid in prior 12 months; free software — $[50–100] or max permitted by law
- Cap is collective across all claims; does not reset per claim
- **Carve-outs** (narrow): gross negligence / willful misconduct; death/personal injury; fraud; mandatory statutory rights
- Claims must be brought within 1 year of accrual
- Savings clause for jurisdictions limiting damage exclusions

### 10. Indemnification

**Licensor → User (IP, if offered):**
- Defend/indemnify for claims that unmodified Software infringes registered patents, copyrights, or trademarks
- Conditions: prompt notice (≤10 days); licensor controls defense; user cooperates
- Exclusions: user modifications; unauthorized combinations; non-current version; out-of-scope use
- Remedies: procure license → modify → replace → pro-rata refund + terminate (exclusive remedy)

**User → Licensor:**
- Defend/indemnify for: breach of agreement; law/third-party rights violations; user content/data; user negligence/misconduct
- Not subject to aggregate liability cap

### 11. Governing Law & Disputes

- [State] internal law; exclude conflict-of-law principles and CISG
- Exclusive jurisdiction: [County, State] state and federal courts
- **Arbitration** (if included): AAA Commercial Rules; [city]; 1 arbitrator (<$100K) / 3 (≥$100K); licensor pays costs for consumer claims
- **Class action waiver**: individual capacity only [enforceability limited in CA consumer contexts — confirm]
- Carve-out: equitable/injunctive relief for IP or confidentiality violations
- Consumer savings clause: unenforceable forum selection defaults to user's jurisdiction

### 12. Data Protection

**Include provisions for each applicable regime:**

| Regime | Trigger | Key Obligations |
|---|---|---|
| GDPR | EU/EEA users | Lawful basis, data subject rights, 72-hr breach notice, SCCs, DPO if required |
| CCPA/CPRA | CA users | Category disclosure, opt-out of sale/sharing, deletion/correction rights |
| COPPA | Users under 13 | Verifiable parental consent before collection |
| HIPAA | PHI for covered entities | BAA required; Privacy & Security Rule compliance |
| GLBA | Financial data | Safeguards Rule compliance |
| FERPA | Student records | Institutional consent; no unauthorized disclosure |

- Disclose: data collected, purpose, retention, third-party sharing, security measures
- No absolute security guarantees; user responsible for credential security
- If software not designed for sensitive data: explicit prohibition + liability disclaimer

### 13. Export Controls

- Software subject to EAR (15 C.F.R. Parts 730–774 [VERIFY]); ITAR if defense application
- User represents: not in embargoed country (Cuba, Iran, North Korea, Syria, Crimea/Donetsk/Luhansk — verify current OFAC/BIS lists); not on SDN, Denied Persons, or Entity List
- No export/re-export without required licenses
- Violation = material breach → immediate termination; user indemnifies

### 14. General Provisions

| Provision | Key Points |
|---|---|
| Entire Agreement | Supersedes all prior; no extra-contractual reliance |
| Amendment | Post + 30-day notice; material paid-license changes require re-acceptance |
| Severability | Reform to minimum extent; per-jurisdiction independence |
| Waiver | Written and signed; no implied waiver |
| Assignment | User cannot assign; licensor assigns freely (including M&A) |
| Force Majeure | Acts of God, war, pandemic, infrastructure failure; termination right if >60–90 days |
| No Partnership | Independent contractors; no agency/JV/franchise |
| Third-Party Beneficiaries | None except third-party component licensors (IP) |
| Notices | Email (confirmed) or certified mail; in-software posting for general notices |
| Counterparts | Electronic signatures valid |

## Pitfalls & Checks

- **Conspicuousness**: warranty disclaimers and liability caps MUST be ALL CAPS or bold — never buried in body text
- **Click-wrap over browse-wrap**: require affirmative acceptance; no pre-checked boxes
- **EU consumer contracts**: Unfair Contract Terms Directive prohibits significant-imbalance provisions; user's habitual-residence law applies (Rome I) — disclaim only what is permissible
- **Class action waiver**: may be unenforceable in CA consumer contexts — confirm before including
- **Open-source audit**: confirm no GPL/AGPL copyleft that would require disclosing proprietary code
- **App store overlay**: Apple/Google impose payment, refund, and content terms — EULA must complement, not contradict
- **Do not include**: specific hypothetical damages amounts; representations about unlicensed third-party products; absolute security guarantees