Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Consensys asserts ownership over all improvements and derivative works created using de-identified metadata, usage patterns, and aggregated performance data derived from user activity, to the extent permitted by data protection law.
This analysis describes what MetaMask's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes Consensys's ownership claim over algorithmic improvements and derivative works generated from aggregated user activity data, which may interact with GDPR purpose limitation and data minimization obligations for EU/EEA users and warrants review as part of any data mapping or IP rights assessment.
Interpretive note: The qualifying phrase 'to the extent permitted by data protection law' introduces uncertainty about the operative scope of the ownership claim in GDPR and CCPA jurisdictions; the legal standard for effective de-identification under applicable law is a factual and technical determination.
The updated terms explicitly state that UK, EU, and EEA consumers retain statutory consumer protection rights that cannot be limited or excluded by the agreement, and that applicable local law prevails in the event of conflict with these terms. This adds clarity to the legal framework but does not change substantive protections for those users. The terms also clarify that mUSD is a third-party digital asset not issued by Consensys, treating it as a third-party service subject to the agreement's limitations on Consensys' responsibility for third-party services.
View change record →Under this clause, Consensys claims ownership of all improvements and derivative works it creates from de-identified and aggregated data derived from users' Offering use. The Agreement qualifies this claim with the phrase 'to the extent permitted by data protection law,' acknowledging that applicable law may constrain the scope of this authorization.
Cross-platform context
See how other platforms handle Usage Data Ownership and Derivative Works Claim and similar clauses.
Compare across platforms →Monitoring
MetaMask has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Notwithstanding anything to the contrary, we may use de-identified metadata, usage patterns, and aggregated performance data derived from your use of the Offerings ("Usage Data") to improve our algorithms and Offerings to the extent permitted by data protection law. You agree that we own all right, title, and interest in and to any improvements or derivative works created using such Usage Data.Excerpt from MetaMask's Terms of Use
(1) REGULATORY LANDSCAPE: This provision engages GDPR Articles 5 (purpose limitation, data minimization), 6 (lawful basis for processing), and 89 (safeguards for processing for archiving, research, and statistical purposes) for EU/EEA users. The de-identification and aggregation qualifiers are operationally significant under GDPR's definition of personal data and the standard for effective anonymization. CCPA's provisions on de-identified data and consumer rights may also apply for California residents. (2) GOVERNANCE EXPOSURE: Medium. The ownership claim over derivative works from usage data is operationally significant for IP governance and may require assessment under applicable data protection law in each jurisdiction. The document's qualifying phrase 'to the extent permitted by data protection law' introduces interpretive uncertainty about the actual scope of the claim in practice. (3) JURISDICTION FLAGS: EU/EEA users under GDPR and California residents under CCPA have heightened exposure. The effectiveness of de-identification under GDPR's standard (which requires that re-identification be reasonably impossible) is a jurisdiction-specific factual and technical question. UK GDPR post-Brexit applies equivalent standards for UK users. (4) CONTRACT AND VENDOR IMPLICATIONS: Business accounts and API integrators should assess whether usage data derived from their users' activity flows to Consensys under this clause, and whether their own privacy policies and user agreements disclose this downstream usage and ownership claim. Data processing agreements (DPAs) with Consensys should be reviewed for consistency with this provision. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should conduct data mapping to identify what metadata and usage patterns are collected and processed under this clause, verify that de-identification meets the applicable legal standard in each relevant jurisdiction, assess whether the IP ownership claim over derivative works is disclosed in the applicable privacy notice, and review whether the qualifying phrase 'to the extent permitted by data protection law' is operationally implemented through technical or contractual controls.
This provision establishes Consensys's ownership claim over algorithmic improvements and derivative works generated from aggregated user activity data, which may interact with GDPR purpose limitation and data minimization obligations for EU/EEA users and warrants review as part of any data mapping or IP rights assessment.
Under this clause, Consensys claims ownership of all improvements and derivative works it creates from de-identified and aggregated data derived from users' Offering use. The Agreement qualifies this claim with the phrase 'to the extent permitted by data protection law,' acknowledging that applicable law may constrain the scope of this authorization.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by MetaMask.