The Terms of Service Has Become Firmware

A contract you can compile

For most of software's commercial life, the terms of service was a document with the properties of a document. It could be read, quoted, argued over, and occasionally interpreted by a judge who had in fact read it. Enforcement was slow, expensive and human. That period has closed without anyone announcing it. The promises, prohibitions and entitlements once written in prose now ship as instructions: compiled, signed, and executed by the product itself at machine speed, with no witnesses and no correspondence. The fine print has not vanished. It has been given a compiler.

The clause that arrives with the update

Fact. Components are increasingly matched to a body by serial number, so a genuine part installed by a competent hand is refused until an authorised workflow blesses it. Cartridge authentication routines have shipped as firmware updates that retired third-party consumables already sitting in drawers. Features sold as part of a vehicle or an appliance are held behind an account entitlement that can be granted, suspended or withdrawn. Warranties end through inactivity clauses executed by scheduled jobs that do not negotiate. And when a service is retired, the licenses it carried are retired with it: game libraries, e-books and cars that no longer connect have all been known to go dark in a single morning, refund processed, terms satisfied.

Fact, continued. None of this is unlawful by default. In several jurisdictions, circumventing the authentication layer that enforces these arrangements is unlawful regardless of what the contract says. A licence you may breach is one thing; a lock you may not touch is another. The two instruments have been bolted together.

What is lost: the appeal

Interpretation. A sentence can be read two ways; a firmware version cannot. The old contract had ambiguity built into it, and ambiguity was a kind of due process: notice, cure periods, implied warranties, a forum where a human could decide a term was unconscionable and set it aside. The new arrangement converts each of those into a boolean. Remedies become outages. If the check fails, nothing happens, and nothing happening is not a cause of action you can file on a Tuesday.

The second change is economic. Enforcement used to cost money, which meant companies enforced only the clauses they cared about, which in turn meant the rest of the document was closer to weather than to law. When enforcement drops to near zero marginal cost, ambition expands to fill whatever the code can reach. Prohibitions multiply because prohibitions became free. The document did not get stricter. The cost of being strict went away.

The third is procedural. With an authentication routine in the middle, the question is no longer whether you are entitled but whether you are permitted, and those are adjudicated by different bodies. One is a court. The other is a certificate.

The concession nobody volunteers

Interpretation. Terms written in prose were close to unfalsifiable. A company could assert compliance with a policy nobody outside the company could test, and the reader had no instrument capable of checking the claim. Behaviour, by contrast, is observable: a teardown, a network capture, a log, a stopwatch. Each turns a promise into a measurement. Every clause that has been pushed into code has also become, for the first time, auditable by a stranger. The fine print got much better at being wrong in public.

Fact. Legislators have begun writing amendments in the same idiom. The European charger rule is not a principle about cables; it is a hardware specification with the force of law. Repair legislation in the EU and in several US states does not ask manufacturers to promise fair access to parts; it constrains what the pairing routine is permitted to do.

Prediction. Regulators will increasingly behave like maintainers of a fork they did not write, and compliance work will start to resemble patch review: here is the diff, here is the behaviour required by a date. Disputes will be argued in the language of test suites as often as in the language of statutes, and the companies that fare best will be those that can explain their own refusal conditions.

When nobody is left to honour it

Fact. Courts have begun treating the code-and-contract stack as a system to be inspected rather than a text to be interpreted. A 2024 EU ruling recognised that circumvention can be lawful where it serves interoperability with programs the user already holds, while libraries have spent a decade arguing that an abandoned online service is a cultural object rather than a lapsed agreement.

Prediction. The next frontier is the silence after the vendor stops answering. Expect pressure for sunset disclosure at the point of sale, for escrow of the server components a licence quietly depends on, and for a recognised category of maintenance mode in which a product that can no longer phone home is permitted to function locally. A licence with no one left to honour it is not really a licence. It is a fossil with a EULA attached.

Read it, or watch it run

The practical literacy being replaced is reading. Nobody read the old document, granted, but the skill that mattered was prose literacy: find the clause, weigh it, decide. The skill that matters now is systems literacy: observe what the product does, trace which conditions produce which refusals, and infer the rule from the behaviour. The log file is the fine print now, and it updates itself.

Which leaves an odd inversion. The document too long to read became a machine nobody looks at; the machine everybody looks at was built from a document nobody read. Somewhere between the two sits the only question still worth putting to any product: not what does it promise, but what does it refuse, and who is standing there when it does.