3

As we all know, Android security is a mess. Google fixes security bugs, but it's a matter of luck whether your vendor or carrier decides to deploy the fix to your phone or tablet.

In the European Union, there is a mandatory 2-year guarantee for all goods: Faulty goods must be repaired, replaced or refunded if a defect which already existed on receipt of the goods is found at most 2 years after purchasing the good.

Has anyone every tried this w.r.t. security vulnerabilities? I.e., purchase a new, shrink-wrapped device (perhaps a cheap device that was released a few years ago but is still being sold) and then, after using it for about a year, force the trader to take it back because it no longer receives security updates?

On the one hand, all conditions for the 2-year guarantee should be satisfied:

  • The device was bought less than 2 years ago,
  • the defect was already present when the device was bought, and
  • the device can no longer serve its intended purpose (surf the web without getting your device compromised, your passwords stolen and, thus, your bank account emptied).

On the other hand, I have never heard or read about such a case, so I might be missing something obvious...

Improve this question
3
  • They might argue that "surf the web without getting your device compromised" is an unreasonable standard to hold them to - like requiring that a window be impossible to smash, or a car be impossible to steal. Not saying it is a good analogy, but a court might buy it.
    – Nate Eldredge
    Jun 23, 2017 at 2:02
  • "2 years" is not mandatory. "Reasonable amount of time" is.
    – gnasher729
    Jun 24, 2017 at 13:03
  • 1
    @gnasher729: [citation needed]
    – Heinzi
    Jun 25, 2017 at 6:32

1 Answer 1

Reset to default
3

No, it does not. There is indeed a 2-year guarantee for all goods, but "goods" is defined to be a "tangible movable item" according to Directive 1999/44/EC Article 1, subsection 2(b). In less legalese, a physical item; software doesn't count.

While there has been discussion about extending this protection to software, I'm not aware of this having been done yet. Even if it were, determining whether goods are "faulty" ultimately comes down to whether it conforms to the contract of sale (Article 2). I think it's likely that vendors in this area would put a disclaimer for unforeseen security vulnerabilities, or something to that effect.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .