loops.video

Been a while. I’ve mostly been posting on the Fedi, but I feel like this is a rather important topic that requires attention.

Recently @dansup has been posting a bunch about loops.video, a federated alternative to Instagram/ TikTok. While I agree that an open, free and federated alternative to these platforms is necessary, I am consistently finding myself questioning the intentions encoded in their Terms of Service.

Before going further, I’ll clarify: loops.video is not currently federating, but federation is planned using the ActivityPub protocol. If it does happen, and the ToS isn’t properly adjusted, it will cause problems.

Predatory ToS #

I won’t go too long on this, so let’s start with this bit from their FAQ:

Does Loops.video own the rights to my content?

No.

You grant us permission to use your content, but you retain full ownership of all your Contributions.

As stated in Section 7 of our Terms of Service, we do not assert any ownership over your Contributions. You retain full ownership of all of your Contributions and any intellectual property rights or other proprietary rights associated with your Contributions. We are not liable for any statements or representations in your Contributions provided by you in any area on the Services. You are solely responsible for your Contributions to the Services and you expressly agree to exonerate us from any and all responsibility and to refrain from any legal action against us regarding your Contributions.

By posting your Contributions to any part of the Services or making Contributions accessible to the Services by linking your account from the Services to any of your social networking accounts, you automatically grant, and you represent and warrant that you have the right to grant, to us an unrestricted, unlimited, irrevocable, perpetual, non-exclusive, transferable, royalty-free, fully-paid, worldwide right, and license to host, use, copy, reproduce, disclose, sell, resell, publish, broadcast, retitle, archive, store, cache, publicly perform, publicly display, reformat, translate, transmit, excerpt (in whole or in part), and distribute such Contributions (including, without limitation, your image and voice) for any purpose, commercial, advertising, or otherwise, and to prepare derivative works of, or incorporate into other works, such Contributions, and grant and authorize sublicenses of the foregoing. The use and distribution may occur in any media formats and through any media channels.

If getting a full-blown free-use license to the content isn’t “rights” that loops.video will own, should a user “agree” to these terms, then I don’t know what is.

Let’s have a think here. To operate a platform like this, what are the necessary uses?

1. Permission to store the data (text, images, other media that may be uploaded to the platform.)
2. Permission to transmit the data.

Given the nature of federated networks based on the ActivityPub protocol, this may be easily summarized as:

Permission to store and transmit your data to the recipients of your choosing.

That’s it.

When you use ActivityPub based infrastructure (because this is fundamentally infrastructure), you are able to choose who will be able to see and access the content you publish to the network.

The front-end (whether you use Mastodon, Akkoma, Pleroma, Misskey, Sharkey, PixelFed, Lemmy, or any of the other implementations) is nothing more than a user interface that allows you to interact with that infrastructure.

It’s no different than e-mail or any other telecom network in this way.

From this perspective, why does loops.video make its users agree to the following?

By posting your Contributions to any part of the Services or making Contributions accessible to the Services by linking your account from the Services to any of your social networking accounts, you automatically grant, and you represent and warrant that you have the right to grant, to us an unrestricted, unlimited, irrevocable, perpetual, non-exclusive, transferable, royalty-free, fully-paid, worldwide right, and license to host, use, copy, reproduce, disclose, sell, resell, publish, broadcast, retitle, archive, store, cache, publicly perform, publicly display, reformat, translate, transmit, excerpt (in whole or in part), and distribute such Contributions (including, without limitation, your image and voice) for any purpose, commercial, advertising, or otherwise, and to prepare derivative works of, or incorporate into other works, such Contributions, and grant and authorize sublicenses of the foregoing. The use and distribution may occur in any media formats and through any media channels.

This license will apply to any form, media, or technology now known or hereafter developed, and includes our use of your name, company name, and franchise name, as applicable, and any of the trademarks, service marks, trade names, logos, and personal and commercial images you provide. You waive all moral rights in your Contributions, and you warrant that moral rights have not otherwise been asserted in your Contributions.

We do not assert any ownership over your Contributions. You retain full ownership of all of your Contributions and any intellectual property rights or other proprietary rights associated with your Contributions. We are not liable for any statements or representations in your Contributions provided by you in any area on the Services. You are solely responsible for your Contributions to the Services and you expressly agree to exonerate us from any and all responsibility and to refrain from any legal action against us regarding your Contributions.

We have the right, in our sole and absolute discretion, (1) to edit, redact, or otherwise change any Contributions; (2) to re-categorize any Contributions to place them in more appropriate locations on the Services; and (3) to pre-screen or delete any Contributions at any time and for any reason, without notice. We have no obligation to monitor your Contributions.

?

What the hell happened there?

Let’s break it down step by step.

By posting your Contributions to any part of the Services or making Contributions accessible to the Services by linking your account from the Services to any of your social networking accounts,

Let’s dig a little into what “Services” means here, to understand the root of the problem.

At the top of the legal terms, we see:

We operate the mobile application Loops by Pixelfed (the “App”), as well as any other related products and services that refer or link to these legal terms (the “Legal Terms”) (collectively, the “Services”).

This necessarily includes the technology infrastructure operated by loops.video. Meaning, if an ActivityPub instance is federating with them, and a user post, profile, or any data, finds itself on their servers or networks, they’re assuming consent to these terms, even if the user wasn’t aware that this took place.

you automatically grant, and you represent and warrant that you have the right to grant, to us

Naturally they’re trying to excuse this lack of consent by claiming that the consent is automatic, because apparently asking for consent is too hard.

an unrestricted, unlimited, irrevocable, perpetual, non-exclusive, transferable, royalty-free, fully-paid, worldwide right, and license

Just so you understand, this is bonkers. Let’s go for it step by step.

• unrestricted, unlimited Means they can do whatever they want to that data, without any limits or additional licensing necessary. Currently they claim they aren’t selling user data to advertisers or using it for training AI. Tomorrow they might, and since the user “agreed” to these terms(1) (1)Even without being aware of this agreement. , they won’t be in any breach of contract, even if the user trusted them not to while consenting to this(2) (2)Again, intentionally or not. .
• irrevocable, perpetual Means they have license to use collected user data forever, and users aren’t able to ever revoke this license. The data becomes effectively owned by loops.video at this point.
• transferable Means they can give further effective ownership of this data to anyone they like or have a whim to.
• royalty-free, fully-paid Means users can never ask them to pay up for the use that data, including for commercial purposes.
• worldwide right and license Means they can transfer any collected data anywhere in the world, and process it there. The main issue is that they may very well take it outside of jurisdictions where a user’s data is protected by say, GDPR, if they’re in Europe.

to host, use, copy, reproduce, disclose, sell, resell, publish, broadcast, retitle, archive, store, cache, publicly perform, publicly display, reformat, translate, transmit, excerpt (in whole or in part), and distribute such Contributions (including, without limitation, your image and voice) for any purpose, commercial, advertising, or otherwise, and to prepare derivative works of, or incorporate into other works, such Contributions, and grant and authorize sublicenses of the foregoing.

Let’s do this again:

• to host Means they store the data. Fine, that’s necessary for the stated purpose of the service.
• use, copy, reproduce, disclose Means they need to process (e.g. transcode videos) data, create copies in their infrastructure and display it to the end users. All good so far, these are necessary for their service to work. Note here that disclosure here may mean several different things. I’m going to assume good will on this, that they mean disclosure to the people/ groups intended by the user.
• sell, resell Wait what? Let me get this straight, their FAQ says they don’t sell the data… but they still ask for consent to sell user data! Clown world.
• publish, broadcast This is fine, that’s what the platform is for… unless they mean outside of their stated service, that being the loops.video online platform.
• retitle Means they can change the ownership of the data/ content as they wish. Yet another red flag, which fundamentally undermines their claim that users preserve ownership of their.
• archive, store, cache Fine, necessary for their service.
• publicly perform, publicly display Means they get rights to put user content in public; note that this means they can ignore the user’s chosen privacy options entirely - users may end up posting something very private to a select group of friends, and find that same video anywhere on the web, and loops.video will not be in breach of contract, as they already gave them full license to do what they please.
• reformat, translate This is another red flag. Reformatting means that user content/ data may be used in a different medium, e.g. users give permission to loops.video to use their content not just on their platform, but in print, TV, e-mail (as opposed to the ActivityPub networks), using them on YouTube or other platforms, etc.
• transmit, Well yet, to the end users. Hopefully.
• excerpt (in whole or in part) The only way I can see this as legitimate is if they’re going to have small excerpts of the video used as thumbnails, like YouTube does. But of course they won’t, this ToS is clearly predatory to the bone.
• distribute such Contributions (including, without limitation, your image and voice) There you have it. Zero protection for user data. A user interacting(3) (3)In any way, intentionally or not! with loops.video surrenders every piece of data (including your name(4) (4)Yes, ‘image’ means a person’s public image with all the other data. These terms are chock-full of misleading legal jargon. , e-mail, face, voice, and all the content they post) to loops.video.
• for any purpose, commercial, advertising or otherwise More red flags. The only purpose they need to operate the platform is to distribute user media to the people of that user’s choosing. Personally, I don’t want my data used commercially, or to find my writing or person in the hands of advertisers(5) (5)I have zero expectations that loops.video will have an in-house advertising team. Do you? . And what’s this ‘otherwise’? Why isn’t the distribution of content to the people of the user’s choosing even mentioned(6) (6)To answer my own question: because loops.video is a data-scraping service, and not a video sharing platform. ?
• and to prepare derivative works of, or incorporate into other works, such Contributions Just no? Ignoring the face meaning of this, of using user content for ads or making compilations of videos, derivative works may easily include AI training. Incorporating into other works is also a red flag, since a user may wish to maintain ownership and control over how their content is used. Fair use exists for a reason, and this clause completely bypasses that.
• and grant and authorize sublicenses of the foregoing Means they get to give any kind of license to user data and content to any party of their choosing.

In short, yes, loops.video does practically take full co-ownership of user content; the only right users keep is author’s rights (the right to say they made the original content - but not any derivative works), and the right to grant licenses to the content to other entities aside from loops.video.

Everything else is stripped of the user the moment they interact with the service.

The use and distribution may occur in any media formats and through any media channels.

Any media channels here is dangerous - once they federate, they’ll be able to claim the above rights to any content that interacts with their network infrastructure (which is subject to the same terms of service), and thus start selling any data they pull from the Fediverse/ ActivityPub protocol to third parties.

Going on:

This license will apply to any form, media, or technology now known or hereafter developed, and includes our use of your name, company name, and franchise name, as applicable, and any of the trademarks, service marks, trade names, logos, and personal and commercial images you provide. You waive all moral rights in your Contributions, and you warrant that moral rights have not otherwise been asserted in your Contributions.

Oh wait, users don’t even get to keep author’s rights, since moral rights include the right to attribution and the integrity of the content.

And it gets even better: they claim not to assert ‘any ownership’ over the contribution, yet this entirely contradicts everything they have said so far.

We do not assert any ownership over your Contributions. You retain full ownership of all of your Contributions and any intellectual property rights or other proprietary rights associated with your Contributions. We are not liable for any statements or representations in your Contributions provided by you in any area on the Services. You are solely responsible for your Contributions to the Services and you expressly agree to exonerate us from any and all responsibility and to refrain from any legal action against us regarding your Contributions.

I can’t wrap my head around the mental contortions they’re performing here. Not only do they want to take full charge of the data, they also want to somehow limit their liability, when they effectively take ownership of it.

Here’s some more to end this post.

We have the right, in our sole and absolute discretion, (1) to edit, redact, or otherwise change any Contributions; (2) to re-categorize any Contributions to place them in more appropriate locations on the Services; and (3) to pre-screen or delete any Contributions at any time and for any reason, without notice. We have no obligation to monitor your Contributions.

Do you see this?

Loops.video users explicitly waive any rights to control their content, while at the same time loops.video claims they assert no ownership over the content.

Yet loops.video asserts they gain full license to the content equivalent to complete ownership of it, including personally identifiable information, image, voice, sale, further sublicensing(7) (7)Which doesn’t limit the way they sublicense user data in any way! and more.

Federation #

But let’s go back to Federation, since the above applies to users who signed up using the loops.video platform.

Oh wait, all of this applies to anyone who interacts with any of their services at all, including by proxy(8) (8)I.e. a user’s Mastodon instance is federating with loop.video’s ActivityPub services.

These Legal Terms constitute a legally binding agreement made between you, whether personally or on behalf of an entity (“you”), and Loops.video, concerning your access to and use of the Services. You agree that by accessing the Services, you have read, understood, and agreed to be bound by all of these Legal Terms. IF YOU DO NOT AGREE WITH ALL OF THESE LEGAL TERMS, THEN YOU ARE EXPRESSLY PROHIBITED FROM USING THE SERVICES AND YOU MUST DISCONTINUE USE IMMEDIATELY.

So if someone’s using ActivityPub in any way, and loops.video starts federating using the ActivityPub protocol, all of that user’s data becomes automatically licensed to loops.video for them to use as they will(9) (9)At the moment the data finds its way to any network or service owned by loops.video. – even if they’re entirely unaware of this happening.

Guess what happens then?

ActivityPub becomes yet another data source for whoever offers @dansup a large enough sum.

We have seen this batshit mentality with Bridgy-Fed already, a shameless disregard of user choice, showing a serious lack of understanding and good will.

When I post messages and data to the ActivityPub protocol, I understand it much like e-mail. That’s how it’s supposed to be; admins (individuals and organizations) set up infrastructure which is then used to disseminate messages from users to specific users or groups of users. This is controlled in the protocol, allowing us to dictate who gets to see what we post, and gives us better control over this process overall.

What loops.video is trying to do is subvert this trust in the network and protocol, and lay claim to everything they can get their hands on, not only enriching themselves, but doing so at a major cost to every ActivityPub user in the world.

Worse still, when they update the Terms…

We reserve the right, in our sole discretion, to make changes or modifications to these Legal Terms from time to time. We will alert you about any changes by updating the “Last updated” date of these Legal Terms, and you waive any right to receive specific notice of each such change. It is your responsibility to periodically review these Legal Terms to stay informed of updates. You will be subject to, and will be deemed to have been made aware of and to have accepted, the changes in any revised Legal Terms by your continued use of the Services after the date such revised Legal Terms are posted.

So not only do they want user data, they also want full control over the Terms, and they may change them at any time, without ever notifying users about the changes.

How freaking hard is it to have a public account that automatically posts a diff whenever that page changes? Or a bot that DMs people who have(10) (10)Intentionally or not. fallen into this trap?

Oh wait, it’s another dark pattern that prevents users from understanding the way their data is used. Hell, this would even qualify as bait-and-switch advertising, considering that loops.video is being promoted as a ‘good thing’ for users, without disclosing the predatory data license terms (they’re disclosed only in the ToS, and then misleadingly in the FAQ, where you have to click a drop-down, which doesn’t disclose the loss of moral rights to the data while claiming the user retains ownership).

Privacy Policy #

Another predatory bit, especially for those of us outside of the US.

By using the Services, you agree to be bound by our Privacy Policy, which is incorporated into these Legal Terms. Please be advised the Services are hosted in the United States. If you access the Services from any other region of the world with laws or other requirements governing personal data collection, use, or disclosure that differ from applicable laws in the United States, then through your continued use of the Services, you are transferring your data to the United States, and you expressly consent to have your data transferred to and processed in the United States.

I don’t have to say much, do I? Giving up GDPR just by interacting with this platform is messed up.

But let’s go over the PP:

We may use the collected information to:

• Provide, maintain, and improve our services.
• Personalize your experience on the platform.
• Communicate with you about updates, promotions, and news.
• Monitor and analyze usage and trends to enhance user experience.
• Enforce our Terms of Service and other policies.
• Comply with legal obligations and protect our rights.

Fair enough, but then there’s this (11) (11)While @dansup runs PixelFed, and their ToS and PP are much better, section 6 of their ToS includes the exact same verbiage. https://pixelfed.social/site/privacy#6

We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information. This does not include trusted third parties who assist us in operating our site, conducting our business, or servicing you, so long as those parties agree to keep this information confidential. We may also release your information when we believe release is appropriate to comply with the law, enforce our site policies, or protect ours or others rights, property, or safety.

Who are these trusted third parties? There’s no way to tell.

But here’s the point: these parties ‘assist loops.video’ in conducting their business. Wait, what? What business? What even is loops.video’s business model? So far, at least from my reading on their website, they don’t have any sources of revenue.

But here they’re saying they do sell, trade or otherwise transfer data to ’trusted third parties’ who assist them in ‘conducting their business’ ‘so long as those parties agree to keep this information confidential.’

Do you see the pattern? Let me break this out for you, since it’s another dark pattern in use.

We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information.

This is great, right? But then…

This does not include trusted third parties who assist us in…

@dansup has a lot of questions to answer about this.

Furthermore, when we look at the Third-Party Services section of their privacy policy, we find this wondrous bit.

Our platform may contain links to third-party websites or services that are not owned or controlled by Loops.video. We are not responsible for the privacy practices of these third parties.

While this is ambiguous enough for most people to notice, ‘contain links’ may be interpreted in different ways - one of which is linking core functionality to third party websites or services, which may be ‘assisting in conducting their business.‘(12) (12)Some may think this is nitpicking, but I have spent enough time around hot-headed startup entrepreneurs to know a red flag when I see one.

This isn’t very clear. Who are these third parties? What exactly is the data being transmitted? How are they processing it, and do they get a license to do with it as they please?

Given that loops.video claims full license to do anything with any user data, I can only imagine that @dansup is already preparing to use it(13) (13)Otherwise, why set such predatory terms? . Even if it’s well intentioned and a means to fund loops.video for further development, or to cover costs(14) (14)Video transcoding and storage get expensive fast. , this still isn’t nearly sane enough to justify.

Next steps #

With all this said, @dansup and loops.video are out of line. Given the lack of a real business model stated in the Terms or anywhere on the website, I have near certainty that in addition to the funding of loops.video via PixelFed, user data will inevitably be sold or traded by @dansup in ways the users do not consent to. It’s also not clear if PixelFed will be considered as loops.video infrastructure, which may put current users at risk.

It is my belief that loops.video and @dansup have a social responsibility to contain its ambitions and either:

1. Adjust the ToS to limit the scope of the license to properly reflect the services they offer, ensuring they only acquire license to store, process, and distribute the data they take custody of for the purpose of delivering that data to their intended recipients, ensuring that the user has full control over who those recipients are, without licensing their work and person away.
2. Add a provision exempting ActivityPub users from the predatory licensing terms imposed by loops.video, such that license is granted to cache and transmit (but not store longer than necessary to fulfill the service) the data over loop.video’s infrastructure strictly for the purpose of delivering the data/ content to their intended recipients, with no license to use the data for any other purpose.

Put another way: I just spent 3 hours reviewing this ToS, and I’ll be damned if I let anyone claim any right or license to my person, data, or media beyond what’s strictly necessary to render the service.

So here’s my request:

• If you use loops.video (or are considering it), think carefully about what data loops.video will be given, and whether you’re really comfortable with all of it being entirely out of your control.
• If you use ActivityPub of any flavor(15) (15)Be it Mastodon, Akkoma, Pleroma, Misskey, Sharkey, Lemmy, or anything else. , think about the consequences loops.video federating will have. Effectively the entire user-base will be stripped of fundamental control over their data, and there’s no telling how or by who it will be used.
• If you’re an ActivityPub instance admin, keep an eye on @dansup and the loops.video ToS. If there are no adequate changes, it may be best to respect user choice and ethical integrity by defederating the moment loops.video enables their ActivityPub service.
• If you’re @dansup, get your stuff together. Your personal page says that PixelFed is ethical. Why can’t loops.video be? User consent and letting users own their person, data and media is such a fundamental, easy thing to address, yet everything in your ToS screams ‘give me more data to exploit at no cost.’ FFS.

Anyway. What a freaking mess.

Join the FSF.