software warranties security
Does the EU &quot;2-year guarantee&quot; apply to security vulnerabilities?
<p>As we all know, <a href="https://cpbotha.net/2016/11/27/android-security-in-2016-is-a-mess/" rel="nofollow noreferrer">Android security is a mess</a>. Google fixes security bugs, but it's a matter of luck whether your vendor or carrier decides to deploy the fix to your phone or tablet.</p>

<p>In the European Union, there is a mandatory <a href="http://europa.eu/youreurope/citizens/consumers/shopping/guarantees-returns/index_en.htm" rel="nofollow noreferrer">2-year guarantee for all goods</a>: Faulty goods must be repaired, replaced or refunded if a defect which already existed on receipt of the goods is found at most 2 years after purchasing the good.</p>

<p><strong>Has anyone every tried this w.r.t. security vulnerabilities?</strong> I.e., purchase a new, shrink-wrapped device (perhaps a cheap device that was released a few years ago but is still being sold) and then, after using it for about a year, force the trader to take it back because it no longer receives security updates?</p>

<p>On the one hand, all conditions for the 2-year guarantee should be satisfied:</p>

<ul>
<li>The device was bought less than 2 years ago,</li>
<li>the defect was already present when the device was bought, and</li>
<li>the device can no longer serve its intended purpose (surf the web without getting your device compromised, your passwords stolen and, thus, your bank account emptied).</li>
</ul>

<p>On the other hand, I have never heard or read about such a case, so I might be missing something obvious...</p>

<p>No, it does not. There is indeed a 2-year guarantee for all goods, but "goods" is defined to be a "tangible movable item" according to <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:31999L0044" rel="nofollow noreferrer">Directive 1999/44/EC</a> Article 1, subsection 2(b). In less legalese, a physical item; software doesn't count.</p>

<p>While <a href="https://www.adaware.com/blog/two-year-guarantee-for-software-products-within-the-eu" rel="nofollow noreferrer">there has been discussion</a> about extending this protection to software, I'm not aware of this having been done yet. Even if it were, determining whether goods are "faulty" ultimately comes down to whether it conforms to the contract of sale (Article 2). I think it's likely that vendors in this area would put a disclaimer for unforeseen security vulnerabilities, or something to that effect.</p>
