In a nutshell, Automatic Updates is automatically updating even on Windows XP systems that are set to “no automatic updates.” My colleague Joe Wilcox reported on Windows Automatic Updates and also on Automatic Updates perception problems. Andrew Garcia, one of my eWEEK Lab partners, confirmed the behind-the-scenes-behavior.
Now that we’re all up to speed on Microsoft’s activity, I went digging in the EULA (End User License Agreement) to see if, as many readers told us, this was all perfectly legal and upfront.
As near as I can tell, Windows XP Professional OEM EULA says that Microsoft may automatically download software to a user’s computer. However, the EULA doesn’t give consent for the installation of the downloaded software.
Microsoft distinguishes between downloading and installing updates. In the Automatic Updates configuration screen the options are: 1) Automatically download and install, 2) Download and let me choose when to install, 3) Notify but don’t automatically download or install updates or 4) Turn off Automatic Updates.
In my opinion, here is the relevant paragraph from the EULA. The emphasis is mine:
“Internet-Based Services Components. The SOFTWARE contains components that enable and facilitate the use of certain Internet-based services. You acknowledge and agree that MS, Microsoft Corporation or their subsidiaries may automatically check the version of the SOFTWARE and/or its components that you are utilizing and may provide upgrades or supplements to the SOFTWARE that may be automatically downloaded to your COMPUTER.“
While this may seem to be nit-picking, Microsoft’s 16-page Windows XP Professional EULA is written in a style that defines the very picking of nits.
When I showed the EULA to eWEEK Labs Executive Editor Jason Brooks he said, “If Microsoft is going to download and install updates for components even when the Automatic Updates feature is turned off, then the Automatic Updates page should say ‘turn off most automatic updates.’ ” At the end of the day, yes, Microsoft said they would download updates automatically. But I think there is a big gap between the legalese in the EULA and the expectation a reasonable user or IT administrator would have when clicking on the “Turn off Automatic Updates” button in the Automatic Updates configuration screen.
