Following Qualcomm's acquisition of Arduino, the open-source hardware community is discussing new terms and conditions for Arduino.
Major microcontroller competitor Adafruit argues that the new terms threaten open principles by restricting reverse engineering of cloud tools, claiming perpetual licenses for user-uploaded content, and imposing extensive monitoring on AI-related functions.
Arduino defends these changes, claiming that the restrictions apply only to its SaaS cloud applications, that data processing is standard practice on modern platforms, and that its commitment to open-source hardware remains unchanged.
The debate over Arduino's new terms and conditions
Last week, I spoke with Arduino, Adafruit, and EFF about Qualcomm's October acquisition of the beloved company known for its single-board microcontroller kits.
Much criticism came from rival Adafruit, whose products include hardware kits compatible with Arduino. In late November, Adafruit's executive editor, Phillip Torrone, warned its more than 36,000 followers on LinkedIn that, among other things, Arduino users were now "explicitly prohibited from reverse engineering or even attempting to understand how the platform works without Arduino's permission."
But Arduino responded in a blog post: "The restrictions on reverse engineering apply specifically to our Software-as-a-Service cloud applications. Anything open will remain open."
An Arduino spokesperson said their blog post reassured many readers who expressed "understanding and relief to see our unwavering commitment to the spirit of open source and that Arduino's core mission remains unchanged." However, Adafruit's critical post on LinkedIn garnered over 1,575 likes. I asked both sides to clarify their positions. Does this truly represent a turning point since Arduino was founded in 2004?
Here are their statements:
Reverse Engineering: Cloud Applications and Hardware Circuit Boards
I spoke with Mitch Stoltz, director of competition and intellectual property litigation at the Electronic Frontier Foundation (EFF), who agreed that Arduino "has not imposed any new injunctions on modifying or reverse-engineering Arduino boards."
Like Adafruit, Arduino's primary user base is home enthusiasts. Arduino offers an open-source electronics platform—including single-board microcontrollers like the Arduino UNO—as well as a variety of kits/expansion boards/accessories and development software.
However, Adafruit founder Limor "Ladyada" Fried stated that Arduino's response "underestimates the central role of cloud and network tools in the Arduino experience."
Fried said, "If you visit the Arduino software and cloud pages, you'll find that we strongly recommend using the cloud editor/web IDE and cloud service solutions, especially on platforms like ChromeOS, where the cloud editor is the recommended or only viable option." "So when Arduino says 'these limitations only apply to SaaS,' it means those limitations still apply to the primary Arduino environment that many new users are bootstrapping."
"Furthermore, using these cloud tools typically requires an Arduino account, and the registration process prominently features marketing and profiling consent forms, including consent to the processing of personal data for commercial offers and profiling for customized offers."
"This is very different from the 'download your local IDE and start programming on the hardware' model," Fried said.
She noted that even though the underlying firmware and libraries remain open source, for many users, the real entry point is moving in the direction of: accounts tied to personal data, the introduction of marketing and profiling cues, and association with centralized, subscription-based cloud services.
Understand the license agreement for user-uploaded content
Adafruit's Torrone also stated that Arduino's new documentation "introduces an irrevocable, perpetual license to any content uploaded by users."
However, Arduino argues that they are actually clarifying that "the content you choose to publish on the Arduino platform still belongs to you and can be used to enable features you request, such as cloud services and collaboration tools."
In a subsequent interview, an Arduino spokesperson provided a clearer example:
"If a user uploads their code sketches to their Arduino Cloud subscription, the content remains their own and private, and the license granted to Arduino is strictly limited to performing the requested functionality (such as compiling the sketch in the cloud)."
"If a user uploads code or content to Project Hub or a forum, and all other users can see that content, then Arduino requires the user to grant a distribution license (while retaining ownership of the content)."
"Without this license, we cannot run user projects in the cloud or display their posts in forums, so running any modern cloud service or social platform typically requires such a license."
EFF's Stoltz pointed out that Arduino's previous terms of use also required licensing for published content, stating that this is "normal for any online platform."
However, Stoltz added, "Nevertheless, some changes in the terms are still concerning."
Arduino's previous terms "were unusual in that they allowed users to revoke their licenses at any time. The new terms have removed that feature, making licenses irrevocable. It's disappointing to see a platform that was once particularly focused on user protection revert to the norm."
User data and the right to delete accounts
Arduino also highlighted an additional privacy protection measure: "All users have the right to request the deletion of their accounts and/or content at any time. Once deleted, the content will no longer be visible to other users."
Torrone had complained that "even if the account is deleted, the username will still be retained for several years," but Arduino stated that this was "a misunderstanding of our policy… When a user requests the deletion of an account, we immediately delete the account and remove the user's username from all related forum posts."
The five-year public username retention policy only applies to users who have not logged into their Arduino user accounts for 24 consecutive months and have not submitted any data or account deletion requests. (In this case, Arduino hopes to "attribute contributions to inactive usernames to recognize their contributions to the community.")
Therefore, the Arduino blog post clarified that for users who have been inactive for two years, their accounts will be automatically deactivated, but the username will be retained in the Arduino forums "in response to the explicit request from the forum community to retain attribution for user-generated content." (If a user requests account deletion, "the username will be deleted immediately, and related posts will become anonymous.")
Even so, for these inactive accounts, "the username will be deleted after five years," Arduino... A spokesperson explained, "Related user posts or comments will be anonymized.
This policy is not intended to retain data for commercial purposes, but simply to help preserve content ownership information, a point the community has consistently emphasized is very important."
However, Adafruit's Fried still stated that the way usernames are retained rather than deleted presents a worrying pattern. "These policies choose to treat the community's identities and data as managed assets, rather than something users can have complete control over."
AI capabilities and user monitoring strategies on Arduino
Cultural differences are most evident in the new terms and conditions, which list several "prohibited uses of artificial intelligence," including criminal purposes and illegal activities, intent to cause harm (including spreading disinformation and manipulation or deception), generating facial recognition databases, and military applications.
Arduino's blog post notes that its new AI features are optional, including AI-driven computer vision and audio models, as well as an IDE with pre-trained AI models. However, in the new terms and conditions, Arduino "reserves the right to monitor user accounts and the use of AI products…[to] verify compliance with laws and this policy."
Arduino states that monitoring is conducted to "comply with current laws and regulations, including applicable privacy laws, export controls, and other global regulatory requirements," and to "verify compliance with legal and policy standards." They also add that their ultimate goal is to "protect users and Arduino" and ensure that "AI products operate robustly and reliably."
However, their conditions also include the right to monitor for other reasons, including "managing and operating Arduino's business."
Adafruit founder Leigh Fried stated that Arduino "should certainly comply with applicable laws and respond appropriately to concrete evidence of criminal activity." However, "they should design their AI and cloud products to make surveillance targeted, measured, and clearly interpretable, rather than defaulting to broad surveillance of all users."
"You can't say, 'This code is open source, but it can't be used for military purposes,' and then still call it an open source license," said Leigh Fried, founder of Adafruit.
Fried argues that this is a "persistent posture of surveillance, not just a response to specific, well-founded reports of abuse."
Therefore, open source applications can indeed monitor the creation of facial recognition databases or for military purposes, "as long as they remain transparent about what is recorded, how long it is stored, and the censorship conditions." But there are concerns that "widespread, continuous surveillance undermines user trust, especially in educational/maker environments where there are many minors or hobbyists who expect a relatively private environment."
There's also a larger, more fundamental issue. "A true open source license doesn't allow for restrictions on the areas of use," Fried said. "You can't say, ‘This code is open source, but it can't be used for military purposes,' and then still call the license an open source license."
Once you label something as open source, you can no longer arbitrarily choose "good"and "bad"users. Fried calls this restriction "fundamentally incompatible with open source licensing"and hopes Arduino will remove these restrictions. "If a project wants that kind of control, it should honestly call itself ‘source available' or something similar, not open source."
Torrone points out that Arduino's terms and conditions also stipulate that users promise not to use Arduino's platform or services "to identify or provide evidence to support any potential patent infringement claims against Arduino… or Arduino and its affiliates' suppliers and/or direct or indirect customers."But these specific details seem irrelevant. Fried states that Arduino's usage restrictions "effectively override the freedom that the license agreement is supposed to guarantee."
What are the next steps for Arduino and the open-source community?
"Transparency and open dialogue are fundamental to the Arduino spirit,"a spokesperson said Friday. "We understand the community's concerns and are eager to clarify the facts and reaffirm our commitment to the open-source community."
The spokesperson added, "We are committed to continuing to listen to community feedback."
So what's next for Adafruit? Fried said Friday that Adafruit will not change and will "continue to design and release open-source hardware, providing hardware, firmware, and software that people can learn from, modify, and develop from."The company supports a "multiple"ecosystems and continues its work on Wi-Fi/Bluetooth Low Energy (BLE) chips, the Internet of Things (IoT) based on matter, and the Linux Foundation's real-time operating system, Zephyr.
"We are always happy to collaborate with other makers and companies, including Arduino, as long as the collaboration allows us to launch excellent products with complete documentation and a truly open-source license."
Source: Compiled from thenewstack
