In a nutshell, Automatic Updates is automatically updating even on Windows XP systems that are set to “no automatic updates.”
In mid-September, my colleague Joe Wilcox, editor of Microsoft Watch, reported on suspicions that Microsoft was updating users systems without their consent—even when users had explicitly indicated that they didnt want updates automatically installed. One of my eWeek Labs partners, Senior Analyst Andrew Garcia, confirmed the behind-the-scenes behavior on Windows XP (See Page 42).
The next step, we decided, was to take a look at the Windows XP EULA (End User License Agreement) to determine if users had given Microsoft tacit permission to update their computers without notification or permission.
And so, I went digging in the EULA to see if, as many readers told us, this was all perfectly legal and upfront.
As near as I can tell, the Windows XP Professional OEM EULA says that Microsoft may automatically download software to a users computer. However, the EULA doesnt give consent for the installation of the downloaded software.
Microsoft distinguishes between downloading and installing updates. In the Automatic Updates configuration screen the options are: 1) Automatically download and install; 2) Download and let me choose when to install; 3) Notify but dont automatically download or install updates; and 4) Turn off Automatic Updates.
In my opinion, here is the relevant paragraph from the EULA. (The emphasis is mine:)
“Internet-Based Services Components. The SOFTWARE contains components that enable and facilitate the use of certain Internet-based services. You acknowledge and agree that MS, Microsoft Corporation or their subsidiaries may automatically check the version of the SOFTWARE and/or its components that you are utilizing and may provide upgrades or supplements to the SOFTWARE that may be automatically downloaded to your COMPUTER.”
While this may seem to be nit-picking, Microsofts 16-page Windows XP Professional EULA is written in a style that defines the very picking of nits.
When I showed the EULA to eWeek Labs Executive Editor Jason Brooks, he said, “If Microsoft is going to download and install updates for components even when the
Automatic Updates feature is turned off, then the Automatic Updates page should say turn off most Automatic Updates.”
At the end of the day, yes, Microsoft said it would download updates automatically. But I think there is a big gap between the legalese in the EULA and the expectation a reasonable user or IT administrator would have when clicking on the “Turn off Automatic Updates” button in the Automatic Updates configuration screen.
Check out eWEEK.coms for Microsoft and Windows news, views and analysis.