CO to State Facebook Users: “Shut. Down. EVERYTHING.”

Wednesday we received information that was both surprising and almost unbelievable from a friend and reader of ours over in Colorado. After some digging and communication with other contacts we have confirmed with other schools and the CO State Controller that it appears that the state of Colorado has advised state agencies, including higher ed, to halt the use of Facebook indefinitely. Yes, you read that correctly.

Here’s the issue, as we understand it. Recently, section 15 part 2 of the Facebook Terms of Service was brought to the attention of the state attorney general. That section reads:

15. Disputes
2: If anyone brings a claim against us related to your actions, content or information on Facebook, you will indemnify and hold us harmless from and against all damages, losses, and expenses of any kind (including reasonable legal fees and costs) related to such claim.

The apparent problem is that the CO state constitution forbids such an agreement. Indemnity is the paying of damages or a sum of money paid in compensation for loss or injury, in this case if you were to do something that got Facebook sued, you agree to pay them back. The issue in point seems to be , which states that the state controller has to approve any “contract,” in this case including the Facebook TOS, with regard to the agreement of paying any money out. As a result, they determined the best course of action (legally speaking) was to advise state agencies to suspend the use of Facebook while they work to negotiate around the issue of indemnity. The state attorney general had no comment about the specific instructions or advice given to the organizations, nor about what actions are currently being pursued with Facebook.

So, here’s the thing. It’s not that Colorado is going all “we hate Facebook” on everyone. It’s nothing like that at all. It’s a case where the wild world of web site terms of service is coming into conflict with the realm of state contract law, and people weren’t sure how to respond. As we understand it, the state is or will be negotiating with Facebook to find a resolution to this issue, at which point we can assume agencies will be allowed to resume their use of Facebook (hopefully) normally. But how long that takes, and how successful they are will be variables that we’ll have to wait to find out about. Facebook has never, and reasonably would never actively use indemnity as a weapon to go after users - imagine the PR storm that would follow. More likely, it’s boilerplate legalese that is there just for general protection in cases of serious abuses.

What’s more, this issue isn’t just about Facebook, it’s just what started it. Here’s MySpace’s (it’s actually even worse):

17. Indemnity. You agree to indemnify and hold MySpace, its subsidiaries, and affiliates, subcontractors and other partners, and their respective officers, agents, partners and employees, harmless from any loss, liability, claim, or demand, including, but not limited to, reasonable attorneys’ fees, made by any third party due to or arising out of your use of the MySpace Services in violation of this Agreement and/or arising from a breach of this Agreement and/or any breach of your representations and warranties set forth in this Agreement and/or any Content that you post on, through or in connection with the MySpace Services.

And YouTube:

5. Your Use of Content on the Site
G. You understand that when using the YouTube Website, you will be exposed to User Submissions from a variety of sources, and that YouTube is not responsible for the accuracy, usefulness, safety, or intellectual property rights of or relating to such User Submissions. You further understand and acknowledge that you may be exposed to User Submissions that are inaccurate, offensive, indecent, or objectionable, and you agree to waive, and hereby do waive, any legal or equitable rights or remedies you have or may have against YouTube with respect theretoand agree to indemnify and hold YouTube, its Owners/Operators, affiliates, and/or licensors, harmless to the fullest extent allowed by law regarding all matters related to your use of the site.

And probably one of the scariest ones, Ning:

22. Indemnity

You agree to indemnify, defend, and hold harmless Ning, and its successors, subsidiaries, affiliates, co-branders, contractors, employees, all third-party advertisers, technology providers, service providers or other partners, and each of their respective officers, directors, agents, shareholders, employees and representatives, from and against any third party claim, demand, loss, damage, cost, or liability (including, reasonable attorneys’ fees) arising out of or relating to:

* Your Code, Your Content or Your Social Network;
* Your use of any Non-Ning Code or Third Party Applications;
* Your use or misuse of, or connection to, the Ning Platform;
* Your breach or alleged breach of this Agreement;
* Your violation of any rights (including intellectual property rights) of a third party;
* Your use or misuse of any User data (including Ning Member Data and Network Member Data), including, in violation of the Ning Privacy Policy and
* Your breach or alleged breach of any agreement or policy between you and other Users.

Ning reserves the right, at your expense, to assume the exclusive defense and control of any matter for which you are required to indemnify us and you agree to cooperate with our defense of these claims. You agree not to settle any matter without the prior written consent of Ning. Ning will use reasonable efforts to notify you of any such claim, action or proceeding upon becoming aware of it.

Anyway, I think you get the idea (note that I couldn’t find anything in Twitter’s TOS about indemnity or holding harmless). It’s not that these companies are all “RAWR, WE’RE GONNA TAKE ALL YOU’S MONIESSS!“, it’s just that this is extremely common, protectionary contract verbiage. But, regardless of how innocuous it is, it clearly can have a real world impact on those of us in the public sector, where we have higher rules and laws dictating some of our activities. In Colorado’s case, it’s not that they are responding to a problem that arose, they just want to prevent any issues from happening in the first place. Even if we all know that the threat of any liability here isn’t worth breaking a sweat over, the laws are the laws. Welcome to the world of state employment.

Here’s the advise I can give you: inform yourself. Know what your state’s position is on indemnity clauses in web site terms of service. Ask your legislative liaisons and campus lawyers questions. Once this information gets out very far, you can bet Colorado won’t be the last one to go through this situation, so be sure you are prepared and know your state’s legal traps. And in the same breathREAD TOSs! I know the minute I say that everyone goes “Yeah! We should!“, and then immediately goes back to checking boxes and clicking agree to everything. But the reality is, in private there’s not much risk, but in our day job the rules change. Make sure you understand where these conflicts can happen.

I’ll keep this post updated as we get more information and as news develops. If you’ve been through similar experiences in your state or school, be sure to share them in the comments below.

UPDATE 10.04.08 3:44PM CDT: @brucefloyd tells us “Was just told by someone at @uflorida legal that this is a problem for almost all states, inc Florida…” Additionally, Texas appears to have restrictions preventing indemnification in it’s constitution in article III §50-52 and article XI §3.

UPDATE 10.04.08 4:03PM CDT: I offer up an interesting position on the issue of indemnity clauses in web site TOSs. As I am researching my own state laws, one phrase jumped out at me - ” Any litigation, arbitration or other dispute resolution arising from such contracts would be conducted in the state and any contract provision, covenant or clause that conflicts with these provisions would be void and unenforceable.” So my wondering is does it matter whether or not a TOS has an indemnity clause in a state that doesn’t allow for it to provide indemnification? If it were to go to court, would the court not just say “This clause is not enforceable in this state because it is in violation of state statutes, try again next time.” Sadly, IANAL, so I can only speculate on that. Can anyone provide clarification on that thinking?

UPDATE 10.04.08 4:08PM CDT: Yes, Flickr and Google Custom Search both also have indemnification clauses in their TOSs, as does Amazon Web Services (covering things like S3 and EC2).

UPDATE 10.04.13 11:49AM EDT: In Colorado, the state AG is coordinating with other state agencies to negotiate with Facebook to get a customized TOS. In the mean time, they have apparently ordered users that the course of action currently is to take down any existing pages, as previously mentioned. This is bothersome for me, though, because they will no doubt get a custom TOS, yet they want to completely scuttle all the hard work organizations have done thus far and destroy the communities. There is a cost in social capital here that is extremely high. You don’t cut the arm off before attempting to cure the infection. Some groups are looking in to whether or not alumni or foundation organizations could temporarily take over their pages and be stewards until the issue is resolved.

UPDATE 10.04.15 11:33AM EDT: It appears that the state AG in Colorado is now granting permission, at least to universities, to resume and/or continue using Facebook at this time. Though negotiations with Facebook are apparently continuing, this signals they are likely nearing or confident in the solution to the TOS.

11 Responses to “CO to State Facebook Users: “Shut. Down. EVERYTHING.””

  1. Says:

    Tough to say how far that logic stretches. Other “culprits” could be Flickr, Twitter, instant messenger programs, Google Custom Search (perhaps even Google Apps), Web site hosting companies, Amazon… who knows, pretty much anything Web-based.

    For those really interested in monitoring changes in terms of service, Web services like and their ilk can come in handy.

    • Says:

      I checked on those: Twitter doesn’t have a clause that I can find, but Flickr, GCS, and AWS all do. (noted in the post updates)

  2. Says:

    Yes, if this truly is an issue of legal wrangling around the indemnity clauses, then how far does this logic stretch? Chances are good most 3rd party services or products have an indemnity clause. I mean, by this logic, if a similar clause is in the Apache license and I run Tomcat, should I take my entire website down?

    In any case, I’m waiting to see what really comes of this and to hear an official statement of some sort.

  3. Says:

    Government agencies have arranged special TOS statements for social media sites (including Facebook). Apparently someone in Colorado didn’t get the memo or contact Facebook. But if they contact the folks at & Facebook they should be given the correct information.

    • Says:

      Which raises the bigger question: Are states expected to negotiate with EVERY web service to arrange a custom TOS to match their needs? Isn’t the better solution to properly accommodate such activity by fixing the state laws?

      • Says:

        How exactly would you go about fixing the state laws? As long as the indemnity clauses are out there, fixing state laws aren’t going to circumvent the fact that the state controller’s office still has to approve the “contract” with these services, and still have to appropriate funds to go toward any litigation arising from the indemnity.

        No, probably the state’s only recourse at this point is to negotiate with these services and try to get the clause removed or altered.

        The entire reason this debacle is happening is because agents of the state are creating “official” Facebook pages and therefore are committing state funds toward indemnifying Facebook of any wrongdoing. That’s where the AG’s office is seeing the fault. So would you leave the individual agents holding the bag? Cause the money’s gotta come from somewhere.

  4. Says:

    @TheMetOnline: And that’s the $64.000 question, isn’t it? But, to play devil’s advocate, how can the state be expected to negotiate with every web service over their TOSs? You’d be creating a brand new full time position, and by itself they still probably wouldn’t keep up. Consider, hundreds, probably thousands of TOSs to deal with in the course of a year.

    When I think about changing laws, my thought is along the lines of establishing legal ground for the state to have the position that 1) web service TOSs that don’t involve a monetary exchange wouldn’t have to be approved by a state controller (or equivalent), and 2) a state can’t be held liable under an unnegotiated TOS that said state or agent thereof agreed to as a condition of service.

    So, state agency does something dumb on Facebook, someone sues Facebook because of it, Facebook goes to state for indemnity, state says “Sorry, under state law we aren’t bound by unnegotiated indemnity.” That leaves the web service provider the options of either dealing with the fact, or ceasing operations with agents of the state.

    The thing is that the problem isn’t one of sites suing states over indemnity, it’s just a conflict of law based on a technicality. The proper solution then is to correct the law to remove the technicality. Negotiating modified TOSs with web service providers doesn’t actually solve/fix the core problem.

  5. Says:

    There finally has been some Denver press on this:

  6. Says:

    [...] CO to State Facebook Users: “Shut. Down. EVERYTHING.” (tags: facebook highered tos legal law) Possibly related posts: (automatically generated)links for 2010-04-07 Twitter Updates [...]

  7. Says:

    facebook myspace twitter tagged and bebo are all trouble waiting to happen to much of a case of cyberbullying on these sites along with a ongrowing risk of privacy violation and internet perditors would would be a safer place without social network site that are pretty much useless there wasnt social networking 10 year ago and everyone was fine all people do is become obcessed in these sites just to end up bittin in the ass in the end we didnt have nor depended on social networking sites 10 years ago so there is no need to have nor depend on them now people have these sites soley becase they have no lives


  1. links for 2010-04-09 « innovations in higher education --> says:

    [...] CO to State Facebook Users: “Shut. Down. EVERYTHING.” (tags: facebook highered tos legal law) Possibly related posts: (automatically generated)links for 2010-04-07 Twitter Updates [...]