TACTICAL LAW
  • Home
  • Professionals
    • Pamela K. Fulmer
    • Dee A. Ware
    • Julie Bishop
    • Affiliated Counsel
  • Practice
    • Software Audit Defense
    • Licensing & Contract Disputes
    • Litigation
    • ERP Licensing & Disputes >
      • Oracle/NetSuite Disputes >
        • River Supply v. Oracle/NetSuite
    • Advertising and Competition
    • Trade Secrets & Employee Mobility
    • Intellectual Property
    • Arts & Entertainment
    • Tech Transactions
    • Outside General Counsel Services
    • Privacy and Data Security
  • Industries
  • Resources
  • About us
  • Oracle Blog
  • Tactical Law Blog
  • Contact

Oracle Blog

Brown v. GlobalLogic and Oracle: Key Allegations, Oracle E‑Business Suite, and What It Means for Customers

11/13/2025

0 Comments

 
By Pam Fulmer

A new class action filed in the Western District of Texas alleges that GlobalLogic Inc. and Oracle Corporation failed to protect highly sensitive personal information associated with GlobalLogic’s workforce. The complaint, brought by a former GlobalLogic employee, ties the incident to a zero‑day vulnerability that affected Oracle E‑Business Suite (EBS), and it raises significant questions for organizations that run HR, payroll, and finance on Oracle’s flagship ERP platform. A "zero day" (also written as "0-day") refers to a previously unknown software vulnerability that is discovered and exploited by attackers before the software vendor becomes aware of it and has a chance to develop and release a fix or patch. The term "zero day" comes from the fact that the vendor has had zero days to address and remediate the vulnerability. Below is a concise overview of the allegations, the Oracle software at issue, the timeline, and potential implications for Oracle and its customers.

Who the parties are and where the case was filed
  • Plaintiff: Arianna M. Brown, a New York citizen and former GlobalLogic employee, sues on behalf of a proposed nationwide class of individuals whose PII was compromised. (p. 3)
  • Defendants: GlobalLogic Inc. (Delaware; principal place of business Santa Clara, CA) and Oracle Corporation (Delaware; principal place of business Austin, TX). (p. 3)
  • Jurisdiction/venue: CAFA jurisdiction is alleged; venue is the Austin Division of the Western District of Texas based on Oracle’s principal place of business. (p. 3)

What Oracle software is involved?

The complaint squarely focuses on Oracle E‑Business Suite. GlobalLogic allegedly “uses Oracle E-Business Suite, a collection of applications, to manage core business functions such as finance, HR, accounts payable and receivable.” (p. 2) The plaintiff alleges Oracle issued a security advisory on October 4, 2025 concerning a previously unknown zero‑day exploit, that GlobalLogic determined its Oracle instance was exploited, and that the exfiltrated data came from the Oracle platform hosting HR information. (p. 7)
Based on GlobalLogic’s description, the exposed HR data could include names, contact details, dates of birth, nationality and passport information, employee identifiers, SSNs or other national identifiers, salary data, and bank account and routing numbers. (p. 8) For EBS customers, this underscores the sensitivity of the data commonly centralized in HR/payroll modules.

The alleged timeline
  • Earliest threat actor activity: July 10, 2025. (p. 7)
  • Most recent activity: August 20, 2025. (p. 7)
  • Oracle advisory: October 4, 2025 (previously unknown zero‑day). (p. 7)
  • Exfiltration identified: October 9, 2025. (p. 7)
  • Notification: Began November 7, 2025; at least 10,471 individuals impacted according to a filing with the Maine Attorney General. (p. 8 , p. 8)
GlobalLogic states it activated incident response, engaged third‑party cybersecurity experts, notified law enforcement, and applied Oracle’s patches upon release. (p. 7) The plaintiff alleges that notification lagged roughly 120 days after initial malicious activity. (p. 8)

Alleged harms and risks

The plaintiff claims actual misuse (a ~$520 fraudulent debit card charge in or around September 2025), increased spam/scam outreach, and ongoing time and anxiety related to monitoring. (p. 11) The complaint emphasizes continuing risks of identity theft given the breadth of HR data allegedly accessed and notes that the breach notice advised vigilance, fraud alerts, and potential contact with the FTC and law enforcement. (p. 9)

Theories of liability

The complaint pleads six causes of action:
  • Negligence: Alleged failure to implement and maintain reasonable security, to detect unauthorized access, to timely notify, and to adhere to industry standards; foreseeability of harm from compromised PII. (p. 22)
  • Negligence per se: Alleged violations grounded in Section 5 of the FTC Act and related FTC guidance regarding reasonable data security. (p. 25)
  • Breach of Implied Contract: PII provided as a condition of employment, with implied promises (and policy representations) to safeguard and promptly notify; alleged material breach by failing to safeguard and to notify. (p. 27)
  • Invasion of Privacy: Highly offensive unauthorized acquisition and disclosure of highly sensitive PII; alleged knowing inadequacy of security and notification delays. (p. 30)
  • Unjust Enrichment (pled in the alternative): Defendants allegedly benefited from employees’ PII and saved costs by underinvesting in security, unjustly retaining the benefit. (p. 32)
  • Breach of Fiduciary Duty: Alleged fiduciary obligations to safeguard PII, timely notify, and maintain accurate records; alleged breach through insufficient protection and delay. (p. 33)

Requested relief includes class certification, damages (including punitive where available), restitution/disgorgement, injunctive and declaratory relief, fees, and interest. (p. 34)

What this could mean for Oracle
  • Litigation exposure alongside customers: By naming Oracle, the lawsuit highlights a trend where platform vendors may be sued together with customers when a vulnerability is implicated. The complaint asserts that many Oracle customers may have been impacted and that GlobalLogic’s Oracle instance was exploited. (p. 8)
  • Spotlight on secure development and advisories: Oracle’s advisory on October 4, 2025 regarding a previously unknown zero‑day will likely focus discovery on secure development lifecycle, vulnerability disclosure, and emergency patching cadence. (p. 7)
  • Shared responsibility debates: Expect arguments about the division of responsibilities between Oracle (code/vendor advisories and patches) and customers (configuration, identity and access management, monitoring, segmentation). The complaint advances broad duty allegations against both companies. (p. 20)
  • Contract and representations scrutiny: While the complaint quotes GlobalLogic’s privacy policy and recruitment notice to establish data protection representations, plaintiffs may also explore any Oracle contractual terms or security documentation for representations and reliance. (p. 6)

Implications and practical steps for Oracle EBS customers

Given the alleged vector and data at issue, organizations running EBS for HR and finance should consider the following steps:
  • Map and minimize HR data in EBS: Identify exactly which PII elements reside in EBS HR modules and assess encryption at rest/in transit, tokenization options (e.g., SSNs, bank details), data minimization, and retention. The complaint’s description of impacted fields illustrates the breadth of sensitive data often centralized in EBS. (p. 8)
  • Accelerate zero‑day response: Establish a rapid pipeline for processing Oracle critical advisories—triage, exploitability assessment, emergency change windows—and deploy compensating controls (WAF rules, segmentation) while patching. The timeline suggests adversary activity predating public advisories, reinforcing the need for layered defenses. (p. 7)
  • Monitor for exfiltration from EBS: Tune database activity monitoring, DLP, and egress controls to EBS data flows, with alerts for bulk exports or anomalous queries and sufficient logging for forensics. The complaint alleges exfiltration on a particular date, making rapid detection and containment crucial. (p. 7)
  • Rehearse breach notification workflows: Coordinate legal, HR, and IT to satisfy multi‑state notification requirements and avoid delays that can exacerbate harm and litigation risk. The complaint flags a roughly 120‑day gap before notices began. (p. 8)
  • Revisit vendor contracts and SLAs: Clarify roles and expectations for vulnerability disclosure, patch SLAs, hardening guidance, telemetry, and incident coordination among Oracle, managed service providers, and your team. (p. 7)

What to watch procedurally

Defendants will likely contest class certification and move to dismiss certain claims, particularly around the existence and scope of duties, causation, and damages, and whether Oracle, as a platform vendor, owed duties directly to GlobalLogic’s employees. Expect factual disputes over controls in place, detection/notification timelines, and the extent of any misuse. The court’s treatment of duty and causation in a shared‑responsibility context will be closely watched by Oracle customers and other ERP platform users.

Bottom line

Brown v. GlobalLogic and Oracle places Oracle E‑Business Suite at the center of a high‑stakes data breach class action and highlights the operational and legal risks when zero‑days intersect with platforms that centralize highly sensitive employee data. Regardless of outcome, the allegations provide a timely reminder to EBS customers to tighten zero‑day preparedness, harden identity and access, monitor for exfiltration, streamline notification workflows, and clarify vendor/customer responsibilities.

0 Comments

New Class Action Targets Adobe’s “Dark Pattern” Subscription Practices — A Call for Fairness and Full Disclosure

11/12/2025

0 Comments

 
By Pam Fulmer

​A new putative class action filed in the Northern District of California alleges that Adobe deceives consumers into year-long, automatically renewing “annual, billed monthly” plans, obscures material terms and early termination fees in fine print and hyperlinks, and makes cancellation unduly difficult. The complaint also challenges Adobe’s dispute-resolution scheme, alleging the company refuses to pay arbitration fees and then forces consumers into small-claims court, depriving them of meaningful remedies. The suit seeks damages, restitution, injunctive relief, and a declaration that Adobe’s small-claims provision is unenforceable. 

What the case is about
​
•    The core allegation: Adobe prominently advertises per month pricing but defaults consumers into “annual, billed monthly” (ABM) commitments, while failing to clearly disclose that the plan auto renews and carries a steep early termination fee equal to 50% of remaining monthly payments if canceled within the first year. The complaint says these key terms are relegated to fine print and a web of hyperlinks rather than clearly and conspicuously presented at checkout. 
•    Cancellation obstacles: Plaintiffs allege Adobe’s online cancellation flow requires navigating multiple screens, prompts, and sometimes live-agent interactions, with “offers” to deter cancellation; at times, online cancellation may be disabled, pushing consumers to other channels.
•    Dispute resolution concerns: According to the complaint, Adobe requires a pre arbitration “informal” process, designates JAMS arbitration, but then refuses to pay JAMS fees and invokes a “small claims election” to shut down arbitration—effectively routing consumers to small claims court where counsel, discovery, and appeal are limited or unavailable.

Why this matters: fairness and full disclosure

At bottom, the case is about transparency. Subscription sellers must clearly and conspicuously disclose auto renewal terms, obtain affirmative consent, and provide easy, immediate online cancellation. Consumers should not be surprised by hidden minimum commitments, opaque renewal mechanics, or penalty fees buried in small type or behind hyperlinks. While Adobe is the defendant here, the industry at large should take note—companies like Oracle have also been criticized by customers and commentators for burying impactful terms behind inconspicuous hyperlinks. Clear, front and center disclosures and frictionless cancellation build trust, reduce disputes, and align with modern statutory requirements and regulator expectations.
Summary of the claims pled

The complaint asserts California consumer protection causes of action and seeks declaratory relief:

•    Declaratory judgment: A declaration that Adobe’s “small claims” provision is unconscionable and unenforceable; that Adobe has breached or waived any agreement to arbitrate by refusing to pay required arbitration fees; and that its terms do not constitute a valid FAA arbitration agreement as used.
•    California Consumer Legal Remedies Act (CLRA): For alleged misrepresentations and omissions regarding subscription characteristics and cancellation terms; advertising without intent to sell as advertised; representing rights/obligations that differ from reality; and inserting unconscionable terms.
•    False Advertising Law (FAL): For allegedly untrue or misleading statements by commission and omission regarding pricing, plan nature (monthly vs. annual commitment), renewal, and cancellation penalties.
•    Unfair Competition Law (UCL): “Unlawful,” “unfair,” and “fraudulent” prongs based on the same conduct, including alleged violations of the ARL, CLRA, and FAL; seeks restitution, disgorgement, and injunctive relief to stop deceptive designs and mandate clear disclosures.
•    Automatic Renewal Law (ARL) violations as the predicate: Plaintiffs allege Adobe failed to present auto renewal terms “clearly and conspicuously,” failed to obtain affirmative consent, failed to provide a retention capable acknowledgment with cancellation methods, misrepresented material facts, and failed to allow “online, at will” termination via a prominent link or immediate termination email—all resulting in unlawful charges and remedies including restitution. 

Alleged practices highlighted in the complaint

•    “Annual, billed monthly” default and fee disclosure: The ABM plan’s monthly price is emphasized visually; the annual commitment and 50% early termination fee are not clearly called out in proximity to consent, according to plaintiffs. The complaint details screens where fine print is minimized or pushed below the fold, and where the “Terms of Use” and “Subscription and Cancellation Terms” hyperlinks appear only at the final payment stage after personal and billing information is entered.
•    Early termination fee: For ABM plans, canceling in the first year triggers a fee equal to 50% of remaining monthly payments—allegedly a material term not disclosed clearly and conspicuously during enrollment.
•    “Cancel anytime” ambiguity: Plaintiffs say “cancel anytime” messaging conflicts with fee deadlines and limited refund windows, confusing consumers about real cancellation rights. 
•    Obstacles to cancellation: Multi page flows, prompts, and occasional forced customer support interactions; sometimes online cancellation is unavailable (e.g., during payment processing issues), contrary to ARL’s “online, at will” mandate, plaintiffs allege. 
•    Arbitration/Small claims pivot: The complaint asserts Adobe refused to pay JAMS’ fees after demands were filed and invoked a small claims election to administratively close arbitrations—then argued consumers must proceed in small claims court, which cannot award the injunctive relief sought under the UCL, FAL, and CLRA. 
Relief sought

Plaintiffs seek class certification; damages; restitution and disgorgement; declaratory relief regarding the dispute-resolution terms; civil penalties; injunctive orders to cure disclosures and cancellation flows; and fees and costs. 
Nature of the class action proceeding

The complaint seeks certification of a nationwide class of all natural persons in the United States who paid for Adobe subscriptions during the applicable limitations period. Plaintiffs allege common questions predominate—such as whether Adobe’s presentation of auto renewal terms was clear and conspicuous, whether affirmative consent was obtained, whether disclosures and cancellation methods satisfied the ARL, and whether marketing and UX choices were misleading or unfair. They contend a class action is the superior method to resolve uniform design and disclosure practices, given relatively modest per consumer losses and the burdens of individual litigation.

Takeaways for businesses and consumers

•    Put critical terms up front: If a plan is annual with monthly billing, say so conspicuously at every relevant step, alongside any early termination fee and renewal mechanics.
•    Obtain clear consent: Secure express, unambiguous assent to auto renewal terms; don’t bury consent in small print or optional hyperlinks late in checkout.
•    Make cancellation immediate and online: Provide a prominent “Cancel” link or button and allow immediate termination without friction or delays, consistent with modern statutory standards.
•    Design for trust: Hidden hyperlinks, fine print traps, or obstructive flows draw litigation and regulatory scrutiny. Companies across the software and cloud ecosystem—including those, like Oracle, that have faced criticism for concealing impactful terms in nested links—should embrace transparent, consumer centric UX and disclosures.
​
Conclusion

The Foret v. Adobe class action illustrates how the modern contract of adhesion has evolved from fine print to fine links. As digital interfaces become the new vehicles for assent, courts and regulators are signaling that hidden hyperlinks and misleading design choices will not withstand scrutiny.
Software and cloud vendors that rely on automatic renewals or tiered billing should review their contracting processes now—before deceptive hyperlink practices become the next wave of consumer litigation.
 
About Tactical Law Group LLP

Tactical Law Group LLP is a boutique law firm focused on technology contracts, software licensing disputes, and failed ERP and cloud implementations. Our attorneys monitor emerging litigation trends affecting SaaS providers, resellers, and customers across the United States.

For further insights into deceptive subscription practices and hidden online agreements, visit tacticallawgroup.com
0 Comments

Lessons from ERP Lawsuits: Key Contract Provisions and Litigation Themes

11/10/2025

0 Comments

 
By Pam Fulmer

​Enterprise Resource Planning (ERP) software is meant to unify a company’s core functions — finance, inventory, HR, sales, and operations — into one seamless system. But when implementations go wrong, they go spectacularlywrong. Multi-million-dollar projects can collapse under the weight of poor planning, hidden contract risks, and unrealistic promises.

Over the last several years, ERP lawsuits have surged as businesses confront failed go-lives, blown budgets, and software that simply doesn’t work as promised. These cases reveal recurring contractual pitfalls and litigation themes that every company should understand before signing — or litigating — an ERP deal.

1. The “One-Sided” Contract Problem

ERP contracts are almost always vendor-drafted, and rarely negotiated deeply enough. These agreements typically limit termination to “material breach,” restrict remedies to “re-performance,” disclaim reliance on pre-contract statements, and cap damages at the fees paid. In other words, the playing field is tilted in favor of vendors such as Oracle and SAP.
In practice, that means the customer is paying for the privilege of having no meaningful remedy when the project fails.

Courts scrutinizing ERP disputes have found that contractual asymmetry—where one side controls performance and the other bears the risk—can support claims of unconscionability, misrepresentation, or even fraud in the inducement. Companies entering new ERP engagements should focus on balancing rights and obligations: termination for cause, realistic service-level commitments, and clear consequences for missed milestones.

2. Misrepresentation and “Sales Cycle Fraud”
​

A consistent litigation theme in ERP cases involves misrepresentations during the sales cycle. Vendors often tout “industry-specific solutions,” “pre-configured accelerators,” or “SuiteSuccess”-type templates that supposedly guarantee rapid implementation. Sales teams are often comprised of individuals who have no real understanding of the technology they are promoting but they are excellent communicators and adept at instilling trust in the unsuspecting customer.  Do not fall for the sweet talking sales person trap.

In many lawsuits, discovery reveals that these representations were marketing talking points, not deliverables. When the customer later discovers that the promised functionality or timeline was unattainable, the question becomes whether those statements were mere “puffery” or actionable misrepresentations. Also, many of the initial scoping meetings are held online via Zoom or Teams.  Vendors avoid putting anything in writing, but are willing to make all kinds of promises orally in the meetings.  Ask vendors for permission to record the meetings.  If they balk, then be ready to take excellent notes and follow-up the meetings afterwards with emails to the vendor confirming what was discussed.  ERP customers need to create their own paper trail to best protect themselves.

Recent decisions suggest that where a vendor’s sales claims are specific (e.g., “this system will meet your regulatory requirements on Day One”), and the customer reasonably relied on them, courts are increasingly willing to let fraud claims proceed alongside breach of contract claims. And under California law, fraud in the inducement will cause any economic loss defense to fail if properly pled at the pleading stage.

3. The “Scope Creep” and Change Order Trap

Another major litigation driver is scope management. ERP projects evolve — modules are added, integrations multiply, and “configuration” quietly turns into “customization.”
If the contract lacks clear change management procedures, vendors often exploit ambiguity to demand additional fees, delay timelines, or avoid accountability. Conversely, if the client pushes changes informally, the vendor may later claim those requests voided the original timeline or deliverables.

Successful ERP contracts establish formal change control processes: written approval, pricing mechanisms, and impact analysis for each modification. In litigation, these documents often become the paper trail proving which party expanded or derailed the project scope.

4. Data Migration and Integration Failures

Data migration is the unsung villain of ERP disasters. Vendors frequently understate the effort required to cleanse, map, and migrate legacy data — leading to failed go-lives and business disruption.  Customers usually have no real understanding of the hours of commitment and hard work that this aspect of the implementation will require.

When litigation follows, discovery often shows that the vendor never performed adequate data assessment or testing. The resulting claims focus on negligent implementation, breach of professional standards, or failure to deliver a system fit for purpose.
Contractually, data migration and integration should be treated as core deliverables, not optional services. Define ownership, responsibilities, and testing protocols in the statement of work — not in vague “collaborative” language.

5. The “Go-Live” Decision and Post-Implementation Failures

A common flashpoint in ERP lawsuits is the go-live date. Vendors push for early go-live declarations to trigger milestone payments or project “completion.” Customers, meanwhile, may be pressured to sign off despite known defects.  Customers should resist such efforts and only sign off when the system is truly ready.  Otherwise, customers are in for a world of hurt.

Once the system goes live, vendors often argue that subsequent problems are support issues, not implementation failures — insulating them from liability under “acceptance” provisions.

Litigation frequently turns on whether the system was ever truly “accepted,” whether acceptance testing was manipulated, and whether the vendor concealed known deficiencies. Clear acceptance criteria and documented testing results can make or break a case.

6. Limitation of Liability and Damages Cap Clauses

Nearly every ERP contract includes a limitation of liability provision capping damages at fees paid — even if the project destroyed millions in business value. Courts generally enforce such caps unless there’s evidence of intentional misconduct, gross negligence, or fraud.

That’s why allegations of fraud in the inducement or willful misrepresentation are common in ERP litigation: they can open the door to consequential damages or rescission despite contractual caps. And as discussed above, many case fact patterns show slick sales teams overselling capabilities and inducing potential customers into expensive cloud software agreements that never really work.

From a drafting standpoint, customers should negotiate carve-outs for fraud, gross negligence, and data loss, and vendors should ensure those carve-outs are narrowly drawn to maintain predictability. If a vendor will not make changes to these provisions, you may want to find another vendor who will.

7. Arbitration vs. Litigation: Procedural Posture Matters

Many ERP contracts require arbitration — often in vendor-friendly venues. Yet post-termination and other disputes can raise intellectual property and data ownership issues that fall outside arbitration clauses.

Recent cases have tested whether unauthorized post-termination use or data withholding constitutes a “contractual” dispute or a statutory or property rights claim, potentially allowing litigation in court despite an arbitration clause.

Counsel should carefully analyze whether an arbitration clause actually governs all disputes, particularly where IP rights or fraud claims are at issue.

Vendors like arbitration clauses because they can cloak their failures in secrecy in confidential arbitration proceedings rather than in a public court of law.  Instead, of agreeing to arbitration, consider deleting such clauses and adopt language that allows parties to seek relief in federal or state court.  The threat of a public lawsuit filing will often cause ERP vendors to be more willing to look for common ground in an attempt to avoid a messy public lawsuit.

8. Lessons for Future Contracts — and Litigation Strategy

The pattern across ERP lawsuits is strikingly consistent:
  • Over-promised and under-delivered software
  • Vague or one-sided contracts
  • Poor project governance
  • Misrepresented implementation readiness
  • Unclear acceptance and change control mechanisms
For companies entering new ERP projects, contract prevention is the best litigation defense. For those already in dispute, success often depends on proving vendor misrepresentation, demonstrating non-performance against contractual standards, and preserving evidence from project documentation and communications.

Final Thoughts

ERP implementations are complex, high-stakes undertakings — but the legal issues that arise from them are surprisingly predictable. Whether advising on contract formation or litigating post-go-live failures, understanding the recurring themes in ERP lawsuits helps clients protect their investments and recover losses when vendors fall short.

At Tactical Law Group, we have seen these disputes play out across multiple platforms. Each case reinforces the same message: technology may change, but contract fundamentals do not.
 

0 Comments

Hidden Traps in Oracle’s Cloud Agreements: What ERP Customers Must Know (and Do) Before They Click “Accept”

11/9/2025

1 Comment

 
If you’re implementing an ERP system, you’re already juggling risk: budget overrun, schedule slippage, change management, data migration, and integration complexity. The last thing you need is a vendor contract that shifts even more risk onto your organization—often invisibly. Oracle commonly tucks its operative cloud terms into URLs or hyperlinks embedded in Estimate/Order Forms. Those seemingly “standard” terms contain multiple one-sided provisions that can leave customers exposed in precisely the moments they most need leverage.

This article analyzes two Oracle form agreements—the Oracle Cloud Services Agreement (CSA) and the Oracle NSGBU Transactional Subscription Services Agreement for NetSuite (NSA)—to highlight the most customer‑hostile clauses, why they matter in the ERP implementation context, the key differences between the forms, and practical strategies for leveling the playing field. Citations to specific clauses appear in footnotes.
Why “URL terms” and buried hyperlinks matter in ERP deals
  • They are easy to overlook. Teams focus on scope, price, and timeline laid out in an Estimate/Order Form and miss how the incorporated web terms reallocate risk to the customer. Both agreements expressly incorporate extensive “Service Specifications,” “policies,” and data protection terms by reference, and Oracle reserves the right to update some of them unilaterally during the term—so what you sign today may not be what governs tomorrow. (Cloud-CSA-Online-v062223-US-ENG.pdf, p. 9 , id., p. 8 , nsgbu-subscription-services-agreement-v061625-us-eng.pdf, p. 1 , id., p. 5) 
  • They move critical obligations off-page. Privacy, security, hosting, and support are often defined in linked policies. If those change mid‑implementation or mid‑incident, your remedies can vanish. Oracle expressly allows updates and says they won’t “materially reduce” performance or security—but Oracle decides materiality, not you. (Cloud-CSA-Online-v062223-US-ENG.pdf, p. 1 , nsgbu-subscription-services-agreement-v061625-us-eng.pdf, p. 5) 
Customer‑hostile clauses to watch—and why they sting during ERP implementations
  1. Non-cancelable, non-refundable orders; invoice splitting
  • What Oracle says: Orders are non‑cancelable and sums paid are non‑refundable (subject to narrow warranty remedies). Payments are due net‑30. You may receive multiple invoices. (Cloud-CSA-Online-v062223-US-ENG.pdf, p. 1 , id., p. 1) 
  • Why this hurts in ERP: If the project derails, you’re often stuck paying for shelfware. “Multiple invoices” can complicate internal controls and dispute management. In NetSuite’s NSA, the fees are similarly non‑refundable and non‑cancelable, and auto‑renewal is the default unless you give notice. (nsgbu-subscription-services-agreement-v061625-us-eng.pdf, p. 3 , id., p. 3) 
  • Level the field: 
    • Add phased acceptance milestones tied to functionality, data migration checkpoints, or integration tests; make future fees contingent on passing acceptance.
    • Insert a termination for convenience (T4C) with a fair wind‑down fee cap and a pro‑rata refund of prepaid, unused fees.
    • Remove or tightly constrain auto‑renewal; require written mutual renewal at negotiated pricing.
  1. “Excess usage” true-ups
  • What Oracle says: If you exceed ordered quantities, you must promptly buy and pay fees for the overage. (Cloud-CSA-Online-v062223-US-ENG.pdf, p. 1 , nsgbu-subscription-services-agreement-v061625-us-eng.pdf, p. 2) 
  • Why this hurts: During rollouts, counts fluctuate (e.g., temporary contractors, test users). Surprise true‑ups mid‑implementation can drain budgets.
  • Level the field: 
    • Include a buffer (e.g., 10–15%) and quarterly reconciliation, not immediate charge.
    • Define who counts as a “User” during testing; exclude non‑production credentials from billable metrics.
  1. Acceptable Use Policy as a suspension lever
  • What Oracle says: Broad “Acceptable Use Policy” with Oracle’s right to take “remedial action,” including removing or disabling access; grounds include benchmarking and performance testing, and Oracle can suspend for “significant threat” or alleged violations. (Cloud-CSA-Online-v062223-US-ENG.pdf, p. 1 , id., p. 4 , nsgbu-subscription-services-agreement-v061625-us-eng.pdf, p. 3 , id., p. 6) 
  • Why this hurts: ERP implementations require load tests, resilience testing, and integration validation. An overly restrictive AUP plus suspension rights can chill necessary diligence, and any suspension mid‑go‑live is catastrophic.
  • Level the field: 
    • Carve out approved performance and security testing in a written test plan with notice and contact protocols.
    • Add a “narrowly tailored suspension” clause requiring Oracle to limit suspension to the affected component, with prior notice, cure periods, and SLA credits for any wrongful or overbroad suspension.
  1. Oracle can update services and policies during the term
  • What Oracle says: Oracle may update services and specifications/policies during the term; it promises not to “materially reduce” performance, functionality, security, or availability. (Cloud-CSA-Online-v062223-US-ENG.pdf, p. 1 , nsgbu-subscription-services-agreement-v061625-us-eng.pdf, p. 5) 
  • Why this hurts: If a key feature is changed or deprecated after you’ve designed processes or integrations around it, remediation costs sit with you unless you negotiate protection.
  • Level the field: 
    • Require “no adverse change” to named critical features; if a change materially impairs your documented use case, secure a right to rollback, extended support, or a fee reduction/termination right with refunds.
    • Lock the specific version of security, hosting, and support policies for the term unless mutually agreed.
  1. Restrictions that block internal benchmarking and reverse engineering
  • What Oracle says: Prohibits benchmarking, availability testing, and reverse engineering; performance or vulnerability testing requires prior written approval. (Cloud-CSA-Online-v062223-US-ENG.pdf, p. 1 , nsgbu-subscription-services-agreement-v061625-us-eng.pdf, p. 3) 
  • Why this hurts: You lose leverage to compare actual performance to promises and to validate capacity before cutover.
  • Level the field: 
    • Negotiate a testing addendum that allows agreed test scripts in pre‑production and limited production windows.
    • Define acceptable data and tooling (e.g., synthetic datasets) and coordinate to minimize impact.
  1. Warranty is narrow; exclusive remedy is limited to correction or partial refund
  • What Oracle says: Warranty limited to “commercially reasonable care and skill” in material conformance with specs; Oracle does not warrant error‑free or uninterrupted service, and your exclusive remedy is correction or, if not feasible, to end the deficient services for a refund of prepaid fees for the post‑termination period. (Cloud-CSA-Online-v062223-US-ENG.pdf, p. 3 , id., p. 3 , id., p. 3 , nsgbu-subscription-services-agreement-v061625-us-eng.pdf, p. 6 , id., p. 7) 
  • Why this hurts: If the service underperforms during a critical cutover, your outage losses (e.g., missed shipments, revenue impact) fall on you, and the remedy is limited to a narrow credit/termination right.
  • Level the field: 
    • Add targeted warranties (e.g., data import tools will process volumes in the migration runbook; integrations will support specific throughput).
    • Incorporate meaningful SLAs with service credits escalating to termination rights; add “implementation protection” credits for go‑live windows.
  1. Liability caps and exclusions that wipe out meaningful recovery
  • What Oracle says: Broad exclusions of indirect, consequential, special, punitive, or exemplary damages, and for loss of revenue, profits, data, data use, goodwill, or reputation; total liability capped at fees paid for the services giving rise to liability in the prior 12 months. (Cloud-CSA-Online-v062223-US-ENG.pdf, p. 3 , id., p. 3 , nsgbu-subscription-services-agreement-v061625-us-eng.pdf, p. 7 , id., p. 7) 
  • Why this hurts: In ERP, most real harms are “indirect” (business interruption, inventory imbalance, missed invoicing). A 12‑month fee cap can be a fraction of your exposure.
  • Level the field: 
    • Carve out from the cap: data breach, confidentiality breach, IP infringement, willful misconduct, and violation of law; set a higher cap for data breach (e.g., 2–3x total contract value) and for implementation‑phase outages.
    • Narrow the consequential damages waiver by reinstating recovery for documented business interruption stemming from Oracle’s uncured material breach or gross negligence during a defined cutover window.
  1. IP indemnity with big exceptions
  • What Oracle says: Each party indemnifies for third‑party IP claims over materials they provide, but Oracle disclaims indemnity for claims based on third‑party content or third‑party portals accessed via the services. Remedies include modifying, licensing, or terminating and refunding unused fees. (Cloud-CSA-Online-v062223-US-ENG.pdf, p. 3 , id., p. 4) 
  • NetSuite NSA mirrors this structure and excludes indemnity for Third Party Applications; many ERP deployments rely on third‑party connectors or SuiteApps—your risk increases as your architecture becomes more realistic. (nsgbu-subscription-services-agreement-v061625-us-eng.pdf, p. 7) 
  • Level the field: 
    • Require IP indemnity to cover Oracle‑approved integrations/connectors and SuiteApps listed in your architecture; ensure the “termination and refund” remedy includes migration assistance and reimbursement of switching costs.
    • Add indemnity for violation of third‑party API terms caused by Oracle’s guidance or tooling.
  1. Data protection is your problem unless you buy add‑ons; HIPAA exclusion in NSA
  • What Oracle says: You are responsible for notices/consents, content vulnerabilities, and regulatory obligations for certain data (e.g., PCI/health) unless specified and covered by add‑on services. (Cloud-CSA-Online-v062223-US-ENG.pdf, p. 2 , id., p. 3) 
  • NetSuite NSA expressly disclaims HIPAA compliance unless specified: Oracle is not your Business Associate; the service may not be used to store/process PHI. (nsgbu-subscription-services-agreement-v061625-us-eng.pdf, p. 3) 
  • Why this hurts: ERP deployments often consolidate sensitive data (customers, payments, healthcare, export‑controlled). Misalignment between your data types and Oracle’s permitted data can create breach and compliance exposure.
  • Level the field: 
    • Inventory regulated data early; align on permitted data in writing. Buy required compliance modules (e.g., PCI) and reflect them in the order; include audit rights and breach response commitments.
    • Strengthen the data processing agreement with specific subprocessor lists, localization, and deletion/return SLAs.
  1. Suspension rights for delinquent accounts and “significant threats”
  • What Oracle says: Oracle can suspend for nonpayment and for perceived security threats or policy violations; during suspension, they’ll make your content/data available “as it existed on the suspension date.” (Cloud-CSA-Online-v062223-US-ENG.pdf, p. 4 , nsgbu-subscription-services-agreement-v061625-us-eng.pdf, p. 6) 
  • Why this hurts: A payment dispute or a false‑positive security flag during cutover can halt operations.
  • Level the field: 
    • Add a “no suspension during good faith dispute” clause when you pay undisputed amounts.
    • Require multiple, escalating notices and a minimum cure period; exclude suspension during agreed go‑live windows, absent imminent, demonstrable harm.
  1. Retrieval and deletion windows at term end
  • What Oracle says: Oracle will make your data available for retrieval for a period specified in service specs, then delete; details are in specs, not the main agreement. (Cloud-CSA-Online-v062223-US-ENG.pdf, p. 5) 
  • Why this hurts: If the retrieval window is short or the export format is limited, your off‑boarding may fail.
  • Level the field: 
    • Negotiate a specific retrieval period (e.g., 60–90 days) and structured export formats and assistance commitments.
    • Add a paid transition assistance clause with defined hours and rates for data extraction and verification.
  1. Assignment bans; audit rights (NSA)
  • What Oracle says: You may not assign; Oracle reserves audit rights (NSA) on 45 days’ notice, annually, with remediation in 30 days if non‑compliance found. (id., p. 8 , nsgbu-subscription-services-agreement-v061625-us-eng.pdf, p. 9) 
  • Why this hurts: M&A or internal reorganizations become friction points; audits during implementation consume resources.
  • Level the field: 
    • Add consent not to be unreasonably withheld for internal reorganizations, change of control, or transfer to affiliates.
    • Limit audit scope, frequency, and hours; exclude implementation sandboxes and pre‑production from “use” counts.
Key differences between the CSA (Oracle Cloud Services Agreement) and the NSA (NetSuite Subscription Services Agreement)
  • Product scope and ecosystem:
    • NSA is tailored to NetSuite and SuiteProjects Pro, with explicit terms for SuiteCloud technologies and SuiteApps (including customer‑developed SuiteApps counted as “Third Party Applications” and subject to Oracle inspection). This makes the integration and customization footprint a contract risk area unique to NetSuite. (id., p. 1 , id., p. 5) 
    • The CSA is more general across Oracle Cloud and leans on “Service Specifications” tied to URLs. (Cloud-CSA-Online-v062223-US-ENG.pdf, p. 9) 
  • Auto‑renewal:
    • NSA auto‑renews for a year unless you give notice 30 days prior; CSA does not contain an explicit auto‑renew provision in the core text provided. (nsgbu-subscription-services-agreement-v061625-us-eng.pdf, p. 3) 
  • HIPAA:
    • NSA explicitly prohibits PHI and disclaims Business Associate status unless otherwise specified; CSA addresses sensitive data at a higher level and pushes PCI/health data to add‑on services and specifications. (id., p. 3 , Cloud-CSA-Online-v062223-US-ENG.pdf, p. 3) 
  • Subsidiary/OneWorld terms:
    • NSA includes specific OneWorld/ Subsidiary Service provisions, including co‑resident environments for parent and subsidiaries and cross‑visibility of content—a governance and privacy risk if not managed. (nsgbu-subscription-services-agreement-v061625-us-eng.pdf, p. 2) 
  • Audit rights:
    • NSA grants Oracle explicit audit rights; CSA text cited here does not include a comparable audit clause. (id., p. 9) 
  • Training/Professional Services:
    • NSA defines Training and Professional Services, their deliverables, and limitations (e.g., no maintenance/updates for training deliverables). The CSA excerpt is focused on cloud services and hardware options; professional services are outside its “cloud hosting” specifications. (id., p. 5 , Cloud-CSA-Online-v062223-US-ENG.pdf, p. 9) 
Tactics to protect ERP customers in Oracle negotiations
  1. Tie money to measurable outcomes
  • Milestone‑based fees with acceptance criteria mapped to your ERP project plan (data migration, key integrations, UAT pass, performance thresholds).
  • Add a right to withhold a portion of fees pending cure of material defects during go‑live windows.
  1. Lock critical features and policies
  • Append a “Critical Capabilities Schedule” listing the exact features, APIs, limits, and security controls you rely on; prohibit material adverse changes, or provide economic relief/termination if they occur.
  1. Strengthen SLAs for implementation reality
  • Demand higher uptime and performance SLAs during cutover and quarter‑end cycles; include response and resolution SLAs for P1/P2 incidents; add service credits escalating to termination rights.
  1. Expand remedies beyond “fix or partial refund”
  • Create custom remedies for migration failure, data corruption, or prolonged underperformance: funded remediation hours, credits against professional services, and reimbursement for documented, reasonable out‑of‑pocket mitigation costs.
  1. Rebalance liability
  • Increase the cap to a multiple of annual fees or total contract value; create super‑caps for data breach and cutover‑window outages; carve back some consequential damages for documented business interruption arising from Oracle’s gross negligence or willful misconduct.
  1. Build a safe harbor for testing and security validation
  • A mutually agreed testing protocol permitting load, failover, and vulnerability testing in defined windows and environments without triggering AUP violations or suspension.
  1. Clarify data handling and exit
  • Specify data types permitted, encryption standards, data residency, subprocessor lists, incident notification timelines, and cooperation duties. At term end, secure a 60–90 day retrieval window, structured exports, and paid transition support.
  1. Control third‑party risk
  • Enumerate approved Third Party Applications/SuiteApps; require Oracle to support interoperability and include those components within IP indemnity scope; add a remedy if an Oracle‑driven API change breaks integrations.
  1. Guard against surprise true‑ups and audits
  • Include a non‑billable buffer and quarterly usage reviews; confine audit rights (NSA) to working hours, limit frequency, and exclude development/test.
  1. Stop silent renewal
  • Replace auto‑renew with express mutual renewal; bake in a cap on renewal increases (e.g., CPI + 3%) and a right to terminate if Oracle seeks higher pricing.
  1. No suspension during disputes and go‑live
  • Add “no suspension during good‑faith billing disputes” with payment of undisputed amounts; restrict suspension during defined go‑live and financial close windows absent imminent harm.
  1. Assignment flexibility
  • Permit assignment to affiliates or successors in corporate reorganizations or change of control with prior notice.
Practical playbook for counsel and project leaders
  • Due diligence before signature:
    • Pull every URL/policy incorporated by reference and snapshot the content at signing.
    • Align the agreement with the ERP project plan: acceptance, milestones, test plans, data types, integrations, and cutover windows.
  • Redline with purpose:
    • Focus on SLA definitions, liability carve‑outs, suspension limits, change‑control for features/policies, and exit assistance.
    • Add an Implementation Annex detailing environments, test rights, throughput/volumetrics, and issue‑management war room procedures.
  • Governance during rollout:
    • Establish a joint escalation matrix; require weekly risk reports; enforce RCA (root cause analysis) obligations for Sev‑1 incidents with corrective action commitments.
  • Preserve leverage:
    • Stage spend; avoid 100% prepayment. Use acceptance gates and holdbacks.
    • Negotiate executive‑level step‑in rights if performance falters.
  • Document everything:
    • Keep contemporaneous records of commitments made in sales cycles and workshops; incorporate them into the order or a binding SOW.
A closing note on tone and leverage
Oracle’s forms are written to protect Oracle. That’s expected—but not inevitable. In ERP, your operational risk dwarfs your subscription fee, so “standard terms” that cap liability at 12 months’ fees while banning consequential damages simply do not reflect your exposure. Do not accept boilerplate on faith. Treat the contract as a control surface for implementation risk: define, measure, and enforce the behaviors you need from your vendor when it matters most.
With disciplined contracting, you can convert invisible hyperlinks into enforceable commitments—and keep your ERP program out of the ditch.
 
1 Comment

Oracle NetSuite Lawsuit: How Courts Protect Big Tech Over Small Businesses

9/3/2025

1 Comment

 
By Pam Fulmer

On September 2, 2025, the U.S. District Court for the Northern District of Ohio issued a ruling that should alarm every small and mid-sized business that has purchased software from global giants like Oracle. In Realscape Group LLC d/b/a Realogic Solutions v. Oracle America, Inc., Judge Charles E. Fleming transferred the case from Ohio to California, enforcing a forum-selection clause hidden deep in Oracle’s online Subscription Services Agreement (SSA)
.
This decision highlights a growing problem in ERP implementation disputes: courts continue to side with large corporations that bury key contractual terms in hyperlinked documents few small business customers ever read. While these rulings may appear to respect “freedom of contract,” they tilt the playing field in favor of big tech giants and against mom-and-pop and other small and medium size businesses, who are exploited by big tech companies and often go bankrupt or face severe financial challenges due to the one-sided clauses in these hyperlinked contracts.
.
Background: Realogic’s Oracle NetSuite Dispute

Realogic Solutions, a small IT services and healthcare staffing company in Ohio, purchased Oracle NetSuite software to manage its accounting, HR, and payroll. Oracle assured Realogic that the system would be fully implemented and operational by July 2025.

But Realogic alleges that Oracle knew it could not meet that timeline and instead of implementing the system itself, Oracle subcontracted the work overseas and sold Realogic’s debt to a third party, Wells Fargo Equipment Finance. The project never succeeded, leaving Realogic without functioning software despite being on the hook to Wells Fargo to pay $184,000 in fees under Oracle’s clever financing arrangement, which effectively severs its performance obligations  from the customer's payment obligations.

Frustrated, Realogic filed a class action lawsuit against Oracle NetSuite, seeking relief for itself and other small businesses nationwide that paid for implementation services but never received working software.  Realogic also sued Wells Fargo in the Northern District of Ohio to seek to invalidate the financing assignment.  The case against Wells Fargo has subsequently been settled and the case dismissed.

The Hidden Forum-Selection Clause

At the center of the case is Oracle’s Subscription Services Agreement, buried in a hyperlink that can only be found on Oracle’s confusing contracts page. Realogic’s order forms contained a one-line reference to the SSA, which included a forum-selection clause requiring all disputes to be litigated in California.

For a small business, being forced to sue in San Francisco or Santa Clara Counties in California is no small matter. The costs of out-of-state litigation often discourage small businesses from pursuing valid claims. Realogic argued that the clause was deceptively hidden in fine print and that Oracle had fraudulently induced them into the deal.

​The Ohio court disagreed. Judge Fleming held that Realogic had over a year to review the SSA hyperlink and was therefore bound by its terms.  In transferring the case to the Northern District of California, the court also reasoned that Plaintiff’s choice of forum was not as important given that the case was a nationwide class action.

​Why This Ruling Hurts Small Businesses in ERP Disputes

1. Hyperlinked Agreements Are Not Real Negotiation
Oracle NetSuite contracts are almost always presented as take-it-or-leave-it deals. The reality is that small businesses have no power to negotiate hidden clauses. Yet courts enforce them as if both parties bargained at arm’s length.
2. Courts Treat Small Businesses Like Large Corporations
The court emphasized that Realogic is a business, not a consumer, and therefore should be held to a higher standard. But small LLCs and family-run companies are far closer to consumers than to Fortune 500 corporations with large and sophisticated legal teams.
3. Forum-Selection Clauses in Contracts of Adhesion Block Access to Justice
Forcing small companies to litigate in California significantly raises legal costs. Many businesses simply give up. Oracle most likely knows this, and it uses such clauses to make litigation for its customers expensive as well as inconvenient.  Sadly many companies will continue to pay Oracle to avoid Oracle and its assignees ruining the company's credit, even though they got nothing of value from the agreement.
4. Oracle Gets a Free Pass on Failed ERP Implementations
By enforcing these clauses, courts allow Oracle to avoid facing consequences for failed NetSuite implementations. Even when businesses allege fraud, misrepresentation, and breach of contract, Oracle can push disputes into its home courts, making litigation prohibitively expensive for smaller plaintiffs.

The Bigger Picture: Oracle NetSuite Litigation and Buried Clauses

​Oracle is not alone. Many software vendors use hyperlinked agreements to impose forum-selection clauses, arbitration provisions, and liability limits. Courts often uphold them in the name of contractual freedom.

But the reality is that these agreements are contracts of adhesion. Not many small businesses buying ERP software can get Oracle to agree to revise its SSA. And when courts enforce them, they prioritize formalistic “consent” over fairness.

Rethinking Forum-Selection in ERP Implementation Lawsuits

To restore balance, courts and lawmakers should:
  • Differentiate between small businesses and corporate giants. A family-owned company or small business should not be held to the same standard as a multinational corporation.
  • Require explicit agreement to forum-selection clauses. Instead of burying them in hyperlinks, companies should obtain clear, affirmative assent.
  • Consider bargaining power. Enforcing hidden clauses against small businesses effectively deprives them of access to justice.
  • Explore legislative reform. Just as consumers enjoy protections against unconscionable arbitration clauses, similar safeguards could help small businesses facing unfair ERP contracts.

Conclusion: Small Businesses Need Protection from Oracle NetSuite Contracts

The transfer of Realogic v. Oracle may look like a routine procedural ruling, but it has Important consequences. By enforcing Oracle’s forum-selection clause, the court has made it harder for Realogic — and small businesses like it — to obtain justice and seek redress for their injuries.

This decision is part of a broader pattern: failed ERP implementations paired with hidden contract terms that trap small companies in unfair forums. Until courts or legislators step in, small businesses remain at a severe disadvantage in Oracle NetSuite litigation.

​At Tactical Law Group, we represent companies harmed by failed ERP projects and unfair vendor practices. If your business is facing problems with Oracle NetSuite, SAP, Workday, Filevine, or other ERP systems, contact us. You deserve a fair fight — and we’re here to help.
1 Comment

Oracle v. Rimini Street: A Decade-Long Legal War Winds Down as Court Stays Proceedings Pending Settlement

7/24/2025

0 Comments

 
By Pam Fulmer

In one of the most interesting and long-running copyright and software licensing battles in enterprise software history, Oracle and Rimini Street have reached a major inflection point. On July 18, 2025, the U.S. District Court for the District of Nevada granted a joint stipulation to stay all proceedings and vacate the case schedule in Oracle Int’l Corp. et al. v. Rimini Street, Inc., Case No. 2:14-cv-01699-MMD-DJA. The litigation—spanning over a decade, multiple trials, and appeals—has shaped the legal landscape governing third-party software support and license compliance.  We have blogged on the case in the past as our readers know, and additional articles can be found on our website.

At Tactical Law Group LLP, we counsel clients navigating complex software licensing issues with large enterprise software publishers, including disputes involving third-party support, software audits, vendor overreach, Oracle Java SE disputes, and failed ERP implementations involving Oracle, NetSuite and other vendors.
 
A Historic Copyright Dispute with Far-Reaching Implications

The Oracle v. Rimini saga began in earnest in 2010 with a separate lawsuit (often referred to as Rimini I), in which Oracle successfully obtained a $50+ million judgment and a permanent injunction against Rimini Street for infringing Oracle’s copyrights in delivering unauthorized third-party support services.

In the second case—filed in 2014—Oracle continued its claims, focusing on Rimini’s continued practices and alleged violations of Oracle’s software license terms, particularly around PeopleSoft, JD Edwards, and other Oracle applications. The litigation has spanned:
  • Complex issues of software copyright infringement,
  • Disputes over the scope of software licenses,
  • Injunction enforcement,
  • Appeals to the Ninth Circuit,
  • And now, a conditional settlement tied to Rimini's cessation of PeopleSoft-related services.

Key Terms of the Court's Stay Order


The July 2025 court order staying the case follows a successful June 2025 mediation between the parties and a subsequent settlement agreement effective July 7, 2025. Rimini has agreed to fully wind down its PeopleSoft support operations by July 31, 2028, after which Oracle will dismiss the case with prejudice. Notably:
  • The court vacated all current deadlines and hearings under the existing case schedule;
  • The stay remains in effect unless breached or completed earlier;
  • If Rimini violates the settlement, Oracle may reinstate proceedings without filing a new lawsuit;
  • The court retains jurisdiction to enforce permanent injunctions previously entered in Rimini I and this case.
This structure provides finality and avoids incurring further litigation costs that have no doubt been substantial, while ensuring Oracle can enforce compliance during the wind-down period.

Why This Case Matters

Enterprise software support has become a major profit center for enterprise software companies such as Oracle.  In fact, it has been said by some in the software industry that large publishers are no longer innovating to grow revenue, but instead are focusing on negotiating annual support uplifts.  Oracle has support policies that are expressly incorporated into its license agreements, so enterprise customers should be aware of those policies and other contractual terms when moving away from Oracle and to third party vendors for support.  The case also illustrates that although Oracle seems at times actually reluctant to sue its customers, it has no such qualms about suing third party support vendors who may be cutting into its lucrative support offerings.  In those cases Oracle will be relentless.

Tactical Law’s Role in Software Licensing Disputes

At Tactical Law Group LLP, we represent licensees in disputes with major software vendors, including Oracle, Micro Focus, SUSE, Microsoft, IBM, Broadcom, Quest, Actian, VMware, Adobe, BSA, Autodesk, Anaconda and others. We have deep experience advising clients on:
  • Interpreting complex software licensing agreements,
  • Responding to license audits and compliance demands,
  • Evaluating third-party support relationships,
  • Challenging unfair contract provisions,
  • Advising clients on license disputes involving downloadable software such as Oracle Java SE and Virtual Box.
  • And litigating disputes involving failed ERP implementations.
Whether you are negotiating a new software agreement, facing a vendor audit, dealing with a failed ERP implementation, or responding to allegations of breach or copyright infringement, Tactical Law can help your company navigate these challenges strategically and effectively.
0 Comments

Another NetSuite ERP Fraud Lawsuit: Veronica’s Auto Sues Oracle for Misrepresentation

4/18/2025

0 Comments

 
Oracle and its NetSuite cloud-based ERP platform are again under legal fire. Veronica’s Auto Insurance Services, Inc. (“VAI”), a California-based insurance company, has filed a lawsuit in San Francisco Superior Court alleging Oracle and NetSuite fraudulently induced it into purchasing a flawed ERP system that ultimately failed to function as promised. The complaint, filed on April 17, 2025, asserts claims for breach of contract, breach of the implied covenant of good faith and fair dealing, fraudulent and negligent misrepresentation, and violation of California’s Unfair Competition Law (Bus. & Prof. Code § 17200).

Alleged Misrepresentations and Broken Promises
According to the complaint, NetSuite sales representatives made a series of specific promises before contract execution to win VAI’s business. These included assurances that the system was tailored for the insurance industry, would require no third-party add-ons, and would be implemented with full Spanish-language support—essential for the client’s predominantly Spanish-speaking workforce. Relying on these representations, VAI signed a Professional Services Agreement and Statement of Work with NetSuite in April 2021, committing to more than $111,000 in fees.

Once implementation began, however, it became clear the representations were untrue. Key functionalities were either missing or required costly third-party plugins. Data migration failed. Core features like vendor payment processing, financial reporting, and role-based user access didn’t work as promised. Worse still, the promised Spanish-language training never materialized, leaving key staff unable to use the system. Ultimately, Veronica’s abandoned the system entirely in 2024, absorbing substantial financial losses.

A Growing Pattern: Oracle ERP Litigation Landscape Expands
The lawsuit filed by VAI is just the latest in a mounting series of legal actions that paint a troubling picture of Oracle’s conduct in selling and implementing its ERP software. In recent years, a variety of businesses across industries have come forward alleging that Oracle misrepresented the capabilities, readiness, or suitability of its ERP solution—often promising a turnkey system that ultimately required extensive customization, failed to deliver key functionality, or came with hidden costs such as required and expensive third party add-ons.

For example, in River Supply v. Oracle, filed by our law firm, Plaintiff alleged that Oracle made sweeping misrepresentations during the pre-contract sales cycle, touting NetSuite as a ready-to-go solution that could be quickly configured to go live within months at a fixed price. But like in VAI’s case, implementation challenges emerged early and often.

In Realscape Group LLC v. Oracle, a class action lawsuit filed in the Northern District of Ohio, the plaintiff has accused Oracle of misrepresenting its ERP system as “off-the-shelf” while concealing the need for significant additional development and expensive third-party software purchases as add-on costs.  Advance Lifts, Inc. similarly claimed Oracle sold it on functionality that did not yet exist.

Additional lawsuits by Morse Communications and Elkay Manufacturing underscore the recurring nature of the same type of complaints raised by the Plaintiff here.  Janco Foods, Inc. v. Oracle America, Inc. provides another stark example. In Janco, a Texas-based food distributor alleged that Oracle failed to deliver on an ERP implementation. The project was never completed, forcing Janco to abandon the system altogether. The complaint alleged breach of contract and fraudulent inducement, claiming Oracle misrepresented both its capabilities and the system’s readiness for the food distribution sector.

Another case, Barrett Business Services, Inc.v. Oracle America, Inc., filed in San Francisco Superior Court, further illustrate how NetSuite implementations often unravel. Barrett, a staffing company, alleged the software failed to meet basic payroll and compliance needs, as well as suffering from other defects. 

And problems with Oracle’s ERP product are not limited to this side of the pond.  Recently, an auditor hired by the City of Birmingham in England issued a scathing report finding fault with the solution.  According to one article, “Since it replaced aging SAP finance software with Oracle's cloud-based Fusion for HR, payroll, ERP, and finance in April 2022, Europe's largest local authority found the system "effectively crippled" its ability to manage and report on finances, auditors found. It was still not "safe and compliant" two-and-a-half years after the replacement went live.”https://www.theregister.com/2025/03/11/birmingham_oracle_auditors/?td=keepreading  The project to “replace an aging SAP system began in October 2019 with an expected budget of £19 million ($23.6 million) and go-live dates of December 2020 and February 2021. Auditors now say the costs may be as much as £130 million ($161 million), and although the new software went live in April 2022, the council is "unlikely to have a fully functioning finance system until at least 2026."  https://www.theregister.com/2025/01/29/birmingham_oracle/

​Together, these lawsuits and others, point to a systemic problem in how Oracle and NetSuite market, contract for, and deliver their ERP solutions. Businesses considering Oracle ERP software should proceed with caution, ensure detailed written documentation of all representations, and fully understand the binding legal terms—often buried in hard-to-access agreements like the Subscription Services Agreement, which is nothing more than a grayed out hyperlink on the Estimate Form.
​
Implications and Advice for NetSuite Customers
The Veronica Auto Insurance lawsuit adds to the growing body of litigation alleging that Oracle/NetSuite uses a bait-and-switch model to sell ERP systems that fail to perform as represented. For businesses considering a NetSuite or other Oracle ERP solution, or currently entangled in a troubled implementation, these cases highlight the importance of documenting all pre-contract representations and seeking legal counsel early. It also reinforces the need to scrutinize every referenced agreement—including "click-through" and incorporated terms not provided upfront.

Tactical Law continues to monitor Oracle litigation closely and represents businesses harmed by Oracle and NetSuite’s practices. If your company has experienced similar issues with Oracle or NetSuite, we invite you to contact us to evaluate potential claims.


Cases
  1. Realscape Group, LLC v. Oracle America, Inc., Case No. 1:24-cv-00558 (N.D. Ohio)

  2. River Supply, Inc. v. Oracle America, Inc. et al., Case No. 3:23-cv-02981 (N.D. Cal.)

  3. Advance Lifts, Inc. v. Oracle America, Inc. et al., Case No. 3:21-cv-04361 (N.D. Cal.)

  4. Morse Communications v. Oracle America, Inc. et al., Case No. 4:21-cv-05363 (N.D. Cal.)
  5. Elkay Plastics Co., Inc. v. NetSuite Inc. et al., Case No. CGC-20-583152 (San Francisco Sup. Ct.)
    Tactical Law Summary
  6. Barrett Business Services, Inc. v. Oracle America, Inc. et al., Case No. CGC-19-572474 
  7. Janco Foods, Inc. v. Oracle America, Inc., Case No. 3:20-cv-05152 LB
0 Comments

The Beat Goes On: Rimini Street Victorious at the Ninth Circuit as the Court Vacates and Remands Key Parts of the Case for Further Proceedings

12/17/2024

0 Comments

 
By Pam Fulmer

Yesterday a three-judge panel of the Ninth Circuit issued a significant ruling in the longstanding copyright and false advertising dispute between Oracle International Corporation and Rimini Street, Inc., a third-party software support provider and Oracle competitor. This latest decision, vacating and remanding key aspects of the district court’s permanent injunction, brings new clarity to derivative works under the Copyright Act, defenses under Section 117(a), and the application of the Lanham Act to commercial statements and what constitutes puffery versus actual misrepresentations.

Case Background
Oracle, a developer of enterprise software including Database and PeopleSoft, has been in litigation with Rimini since 2010. In prior rulings, Rimini was found to have infringed Oracle’s copyrights through processes like “cross-use,” where copies of Oracle’s software were stored on Rimini’s systems. Following these decisions, Rimini restructured its business model into “Process 2.0” and sought a declaratory judgment that its new methods no longer infringed. Oracle counterclaimed for further copyright infringement and false advertising under the Lanham Act.

The district court sided with Oracle, issuing a sweeping injunction requiring Rimini to delete software files and correct alleged misstatements.

The court vacated rulings that Rimini infringed Oracle's Database and PeopleSoft copyrights. For Database, the licensing agreement did not prohibit third parties from possessing copies to support clients' operations. For PeopleSoft, the district court's rulings relied on an erroneous view of derivative works. The court found that the district court erred by focusing on mere interoperability of the software and emphasized that instead the  analysis must focus on whether the work substantially incorporates the copyrighted work.  The court also found that the lower court must conduct a further analysis as to whether the Oracle customers owned a copy of the software so as to make a Section 117(a) defense potentially applicable.  Finally, the Ninth Circuit ruled that several of Rimini's marketing related statements were not actionable as mere puffery, but did find that Rimini's statement that it provided a "holistic" and "multilayered" security actionable.  All in all a big win for Rimini, and a crippling loss for Oracle.  What were the key holdings from the case?
​
Key Ninth Circuit Holdings

1. Derivative Works (Copyright Act)

A copyright owner has the exclusive right to prohibit or authorize the preparation of derivative works.  The Ninth Circuit found that “[t]he district court held Rimini-written files and updates developed during the “Process 2.0” period were infringing derivative works because they “only interact[] and [are] useable with” Oracle software. Oracle Int’l Corp., 2023 WL 4706127, at *66. The Ninth Circuit criticized the district court for adopting “an “interoperability” test for derivative works—if a product can only interoperate with a preexisting copyrighted work, then it must be derivative.”

“A derivative work must actually incorporate Oracle’s copyrighted work, either literally or nonliterally.”
​

The panel emphasized that “mere interoperability” is insufficient to establish derivative status under the Copyright Act, vacating the lower court's findings.  According to the Court:
Here,

“[t]he examples of derivative works provided by the Act all physically incorporate the underlying work or works.” Lewis Galoob Toys, Inc. v. Nintendo of Am., Inc., 964 F.2d 965, 967 (9th Cir. 1992). Take a “translation.” Translating a novel from English incorporates the original expression of the novel in a new language. A motion picture takes elements of the novel’s original expression and incorporates them into an audio-visual experience. The same goes for an abridgment—it incorporates the novel’s original expression into a condensed version. Thus, Congress’s list of examples suggests that a “derivative work” must be in the subset of works substantially incorporating  the preexisting work. Once again, whether a work is interoperable with another work doesn’t tell us if it substantially incorporates the other work."
 
Based on this textual analysis, we’ve said that “a work is not derivative unless it has been substantially copied from the prior work.” Litchfield v. Spielberg, 736 F.2d 1352, 1357 (9th Cir. 1984); see also 1 Nimmer on Copyright § 3.01 (2024) (“A work is not derivative unless it has substantially copied from a prior work.”). And we have held that “[a] derivative work must incorporate a protected work in some concrete or permanent ‘form.’” Lewis Galoob Toys, Inc., 964 F.2d at 967.
 
What does it means to incorporate a work in the software context?  According to the Ninth Circuit:

[T]he incorporation of a preexisting work can take several forms. First, the incorporation can be “literal.” See Best Carpet Values, Inc. v. Google, LLC, 90 F.4th 962, 971 (9th Cir. 2024) (holding that a website’s source code is a “copyrightable literal element[]”). So copying substantial portions of PeopleSoft’s copyrighted code outright would be an example of literal incorporation. 

Second, the incorporation can be nonliteral, such as copying the “total concept and feel” of a preexisting work. Litchfield, 736 F.2d at 1357; see also SAS Inst., Inc. v. World Programming Ltd., 64 F.4th 1319, 1326 (Fed. Cir. 2023) (stating that the nonliteral elements of a computer program “include the program architecture, structure, sequence and organization, operational modules, and user interface”).

 
The Court vacated the lower court’s ruling that Rimini created a derivative work based solely on Rimini’s “programs’ interoperability with Oracle’s programs.” 
​
2. Section 117(a) Defense: Ownership of a Copy Survives

It is well settled that no copyright infringement exists under the Copyright Act if an “owner of a copy of a computer program . . . mak[es] . . . another copy or adaptation of that computer program” for certain purposes, such as when it’s an “essential step” in using the program. 17 U.S.C. § 117(a). Courts have described this provision as an “affirmative defense to infringement.”   According to the Ninth Circuit:

To determine whether a party is an “owner of a copy” of a computer program, we look to whether the party has “sufficient incidents of ownership” over the copy of the software program. See UMG Recordings, Inc. v. Augusto, 628 F.3d 1175, 1183 (9th Cir. 2011) (simplified). And the question is not about ownership of the copyrighted material—it’s about ownership of a copy of the copyrighted material. 

The court vacated the district court's ruling striking Rimini's affirmative defense under 17 U.S.C. § 117(a). The court ruled that other incidents of ownership should be considered to determine if Oracle's customers are owners or licensees of the software copies. The Ninth Circuit ruled that labeling an agreement a “license” does not automatically foreclose ownership claims, and is just one factor to be considered.

On remand, the district court must examine the “totality of the incidents of ownership,” such as transfer restrictions or limitations on use.

3. False Advertising Under the Lanham Act

The court reversed most of the district court's rulings on Rimini's security-related statements as false advertising under the Lanham Act. Many statements were deemed puffery rather than actionable claims. However, the court affirmed that Rimini's claim of offering "holistic security" was false advertising. Notable rulings include:
  • Statements of superiority (e.g., Rimini’s security is “more effective” or “better than Oracle’s”) were non-actionable puffery, as these are generalized claims not grounded in objective metrics.  Surprising to this author, these specific statements were found to be puffery and thus non-actionable:
    • “Security professionals have found that traditional vendor security patching models are outdated and provide ineffective security protection.” 
    • Oracle’s [Critical Patch Updates] are unnecessary to be secure. 
    • It is not risky to switch to Rimini and forgo receiving [Critical Patch Updates] from Oracle. 
    • Virtual patching can serve as a replacement for [Oracle] patching. 
    • “Virtual patching can be more comprehensive, more effective, faster, safer, and easier to apply than traditional [Oracle] patching.” 
    • “Rimini Security Support Services helps clients proactively maintain a more secure application compared to [Oracle’s] support program which offers only software package-centric fixes.” 
    • Rimini provides more security as compared to Oracle. 
    • Rimini’s [Global Security Services] can “pinpoint and circumvent vulnerabilities months and even years before they are discovered and addressed by the software vendor.” 
  • Holistic Security.  However, Rimini’s claim to provide “holistic security”—interpreted as multi-layered security including source-code-level patching—was found false and actionable, as Rimini failed to offer such a service.
  • Security Patches. The court found that this was a closer call but ultimately found these statements non-actionable:
    • Oracle’s [Critical Patch Updates] provide little to no value to customers and are no longer relevant. 
    • Once an Oracle ERP platform is stable, there is no real need for additional patches from Oracle. 
    • If you are operating a stable version of an Oracle application platform, especially with customizations, you probably cannot apply or do not even need the latest patches. 
The court declined to find these statements actionable noting that Oracle’s customers are “some of the most sophisticated companies in the world” and “take the security of their systems seriously.”   The court found it:

"doubtful that any of Oracle’s customers would be fooled about its own security needs merely based on Rimini’s fanciful but vague statements. Indeed, Oracle could not identify “any customers that left Oracle and went to Rimini because of a statement about security.” Nor did Oracle present any evidence of a security breach suffered by a Rimini client. So while these statements border on falsehood, we cannot say that they are so specific and measurable to become actionable under the Lanham Act. We thus reverse." 

Notably, Judge Bybee dissented in part, arguing that Rimini’s statement that Oracle patches were “no longer relevant” was sufficiently specific and absolute to be actionable.

4.  The court vacated rulings that Rimini infringed Oracle's Database and PeopleSoft copyrights.
 

Database

For Database, the licensing agreement did not prohibit third parties from possessing copies to support Oracle customers’ operations.  The court noted that 
[t]he plain language of the Oracle Database licensing agreement did not prohibit third-party support providers, like Rimini, from possessing a copy of Oracle’s software to further a client’s “internal business operations.” Rimini St., 81 F.4th at 854–55. In the appeal of the contempt proceedings, “Oracle [could not] point[] to [any] location restriction” in the Oracle Database licensing agreement. Id. at 855. Nor did the district court here identify a “location restriction” in the use of Oracle Database. While we affirmed any activity that directly fell within Rimini I’s injunction, we declined to extend it to a “different situation.” See id. 
We thus vacate the district court’s ruling that the 18 “gap customer” environments containing Oracle Database violated Oracle’s licensing agreement.
 
PeopleSoft

For PeopleSoft, the district court's rulings relied on an erroneous view of derivative works. Rimini challenged the district court’s ruling that both (1) its use of “automated tools” to deliver PeopleSoft updates from one client to another and (2) the “outright” delivery of PeopleSoft updates to clients without further testing in the clients’ environments constitute copyright infringement.
 
The Ninth Circuit instructed the lower court to reexamine the use of automated tools in light of the legal standard articulated for “derivative work” before deciding whether Rimini’s “automated tools” violate copyright laws.

With regard to “outright” delivery, the district court found that Rimini violated Oracle’s copyright when it developed an update in the City of Eugene’s PeopleSoft environment and then delivered it “outright” to three other clients. But again based on the derivative use standard articulated in the decision, the Panel found that the lower court’s analysis did not go far enough.  Instead,
 
"The district court must first determine whether this update copies Oracle’s protected expression, either literally or nonliterally. If the district court finds protected expression in this update, it would be relevant to know if any extra copies of the update were created in the City’s environment solely because Rimini planned to distribute the update to other clients. In other words, further explanation is required of why “prototyping” the update in the City’s environment for non-City clients “necessarily” violates the “internal data processing operations” provision." 

Implications

This decision has far-reaching implications for software providers and third-party support businesses. By rejecting an overly broad definition of “derivative works” and reinforcing the Section 117(a) defense, the Ninth Circuit has provided stronger defenses to software users and their support partners. Simultaneously, it highlights the risks of overstating service capabilities under the Lanham Act, but also demonstrates a reluctance to reign in misleading statements, as long as the statements are made to sophisticated companies like the ones who use Oracle database software.

​The Ninth Circuit vacated significant portions of the injunction and remanded the case for further proceedings under its clarified legal standards.  All in all, a huge win for Rimini Street and a bitter defeat for Oracle.  One thing is guaranteed.  We have not heard the end of it.
 
0 Comments

How Oracle Uses Online Agreements for “Free Software” to Trap Companies into Paying Large Licensing Penalties: The Hidden Costs of Oracle Java SE and VirtualBox Software

12/1/2024

0 Comments

 
By Pam Fulmer

In the world of enterprise software, Oracle stands out not only for its expansive product offerings but also for its aggressive tactics in enforcing licensing compliance. Among Oracle's most controversial practices is its use of online agreements for software like Java SE and VirtualBox. These agreements allow individuals to download the software free of charge for "certain non-commercial uses," but when those conditions are violated—often unwittingly—companies find themselves on the receiving end of hefty licensing demands.

Oracle's strategy raises serious questions about transparency and fairness in software licensing. This blog explores the issues surrounding Java SE and VirtualBox, the potential legal implications of Oracle’s practices under California law, and potential remedies for affected companies.


The Software at the Heart of the Issue: Java SE and VirtualBox

Java SE (Standard Edition) and VirtualBox are two widely used Oracle products with free versions available for download. Both come with licensing restrictions that create traps for the unwary:
  1. Java SE: Oracle offers Java SE under a dual-license model. The free version is limited to personal use, development, or testing. For "commercial use," a paid license is required. However, Oracle’s definition of "commercial use" is broad and includes any use within a business environment—even if the software is not actively generating revenue. The software can be downloaded for free, and licensing obligations only arise if and when it is used commercially or outside of the limitations set forth in the online agreement.
  2. VirtualBox: VirtualBox, an open-source virtualization software, is free to download for all uses including commercial. However, there is an Extension Pack (that offers a number of additional useful features) that is free for personal and educational use but commercial use requires a separate paid license.​

How Oracle Traps Companies

The mechanics of Oracle’s entrapment are straightforward yet highly effective:
  • Individual Employees Download Software: Employees, often without knowledge of the licensing restrictions, download Java SE or VirtualBox for seemingly innocuous purposes, such as running a tool that requires Java or experimenting with virtualization.  They are not asked for a credit card or otherwise charged at the time of the download.
  • Soft Licensing Audits: Oracle is notified of the download through certain monitoring related technology associated with the software. Oracle may then contact the company and assert that commercial use has occurred, triggering a licensing obligation. The interesting part is that Oracle first started charging for Java in April of 2019.  Although it had information at that time about who was downloading the software Oracle apparently did not reach out and contact the companies to request a licensing fee.  Instead, Oracle apparently let the fees rack up over multiple years before they started their soft audit campaign.  This waiting game allowed them to demand exorbitant penalties.
  • Large Licensing Demands: Oracle typically demands not just a license fee for ongoing use but retroactive fees for the entire period the software was in use, sometimes stretching back years.
  • Ignorance Is No Defense: Companies often argue that the software was downloaded without corporate approval and without knowledge of the licensing terms. Oracle dismisses such defenses, relying on the online agreement to bind the company.
​
​The Role of Click-Through Agreements


​The crux of Oracle’s strategy lies in the click-through agreements that individuals accept when downloading the software. These agreements are often dense and filled with legalese, making it unlikely that employees fully understand the implications. Oracle relies on these agreements to assert that:
  1. The individual user agreed to the licensing terms on behalf of their employer.
  2. Any violation of those terms—such as using the software in a business context for a commercial use—creates a licensing obligation for the employer.
  3. Violation of the terms automatically terminates the license, leaving the employer open to claims of copyright infringement by Oracle.
The unfairness of this approach is evident. Companies often cannot realistically monitor every software download by their employees, and Oracle’s reliance on these agreements exploits that gap.

Legal and Ethical Concerns

​Oracle’s practices potentially raise significant ethical and legal questions. In addition, under California law, which governs many of Oracle's contracts, companies might have claims against Oracle for deceptive business practices.

Deceptive Business Practices Under California Law

California’s Unfair Competition Law (UCL) (California Business & Professions Code § 17200) prohibits “any unlawful, unfair, or fraudulent business act or practice.” Oracle’s actions may fall within this framework for several reasons:
  • Unfair Practices: By allowing free downloads of Java SE and VirtualBox, Oracle creates the illusion that the software is genuinely free. It then imposes retroactive licensing fees that were neither clearly disclosed nor reasonably understood by most users. And it lets these fees rack up over years to extract maximum monetary concessions from the unwitting company. Oracle’s use of complex and opaque click-through agreements could be construed as misleading, particularly if users are unaware that they are binding their employers to licensing obligations, and the employers never authorized or in many cases did not even know of the download.
  • Deceptive Soft Audit Approach: After passively sitting back and allowing years of non-compliance, the Oracle Sales Team makes its calculated move against the company, often in a way that is arguably deceptive.  For example, the Internet is replete with real life stories that a friendly Oracle sales team requested detailed information from the company and claimed in initial communications that Oracle was contacting the company to ensure that the company’s data was secure and that it had the correct securities updates and patches in place.  The company innocently provides the information, but the conversation turns ugly when the targeted company is presented with a large non-compliance bill by Oracle Sales.
  • Expensive Multi-Year Deals: Oracle will often use the alleged non-compliance to force the company into a multi-year Java or Virtual Box deal. There is something unseemly and unfair where Oracle has had knowledge of the usage for years but they let the non-compliance continue so they can claim a large licensing fee in order to move the company into an expensive multi-year licensing deal with Oracle.

Employee Actions and Agency Law
​
Another legal issue arises from whether employees have the authority to bind their employers by accepting Oracle’s licensing terms. Under general principles of agency law, employees typically do not have the authority to enter into contracts on behalf of their employer unless explicitly authorized. Companies could argue that Oracle’s reliance on click-through agreements to impose licensing obligations is invalid unless the employee had actual or apparent authority to act on behalf of the company in the IT context.


What Companies Can Do to Protect Themselves

Given Oracle’s aggressive tactics, companies should take proactive steps to mitigate risks:
  1. Restrict Employee Downloads: Implement policies and technical controls to prevent employees from downloading software without prior approval. Centralized IT controls can help ensure that all software complies with licensing requirements.
  2. Audit Existing Software: Conduct regular internal audits to identify any Oracle software that may have been downloaded and assess whether it is being used in compliance with licensing terms. We partner with technical consultants who can assist companies who decide to make this smart investment and embark on a self audit.
  3. Educate Employees: Train employees on the risks of downloading software without approval, emphasizing the potential costs and legal consequences.
  4. Block Access: Impose controls that would block access to oracle.com and java.com.
  5. Challenge the Claim: If Oracle contacts your company with licensing demands, consider seeking legal advice to challenge all or a portion of the claims. Tactical Law has extensive experience advising companies with licensing disputes with Oracle over Java, and we have successfully negotiated multiple resolutions, which are usually much lower than the monetary penalties that Oracle was seeking to impose.

The Path Forward: Legal Remedies for Companies

Companies targeted by Oracle’s practices may consider legal action to challenge licensing demands. Potential claims may include:
  • Declaratory Judgment: Seeking a court ruling that no licensing obligation exists based on the specific facts of the case.
  • Unfair Competition Claims: Pursuing claims under California’s UCL for Oracle’s deceptive or unfair trade practices.
  • Copyright Misuse: Exploring whether the company may have a claim that Oracle is misusing its copyrights based on the deceptive practices.

Conclusion

Oracle’s monetary demands for the alleged non-compliance are no joke and can run into the millions of dollars.  Oracle’s use of online agreements for “free” Java SE and VirtualBox software creates significant risks for companies that have employees who unwittingly download and use the software. For companies, the best defense is a combination of proactive measures and legal vigilance. By restricting employee downloads, auditing software use, and challenging Oracle’s claims when warranted, businesses can reduce their exposure to Oracle’s aggressive licensing practices.

Tactical Law assists companies that are contacted by Oracle about Java and Virtual Box non-compliance to resolve their licensing disputes with Oracle.  

 


0 Comments

How Oracle Attempts to Limit its Liability With its SuiteSuccess Subscription Services Agreement

10/4/2024

0 Comments

 
By Pam Fulmer

When a company signs a cloud SuiteSuccess ERP agreement with Oracle America, Inc. and NetSuite, Inc. (collectively “Oracle”), it is important to understand the legal framework behind the deal. Oracle's June 1, 2024 Subscription Services Agreement (SSA) for its cloud ERP solutions is instructive and contains several provisions that benefit Oracle by either drastically limiting liability or escaping liability all together. In this blog post, we will explore these provisions and explain why such agreements should never be hidden in hyperlinks buried within a document described as an “Estimate Form”.  

Prospective Oracle customers need to be alert and understand how Oracle often presents its contractual documents to its customers in the ERP cloud solution space.  This may sound like a familiar story if you have dealt with Oracle.  Whether the customer initially reaches out to Oracle, or whether Oracle locates the potential prospect, the playbook is the same.  
Oracle deploys an aggressive sales team, which sets up multiple Zoom meetings ostensibly to gather the customer’s requirements for the ERP solution. Oracle devotes a good deal of resources to these initial meetings giving the customer the impression that Oracle will devote lots of resources to the implementation. Oracle customers in litigation allege that oral promises are made during these meetings, which are often not documented properly or at all in the final contract documents. Instead, customers allege that Oracle simply uses its standard paper promising only a NetSuite standard solution rather than the functionality that was agreed to on the Zoom calls. 

Oracle’s aggressive sales team often does not present the contractual documents ahead of time.  But even if they do, normally they do not include a PDF of the SSA, with the other PDFs provided.  We believe that this is intentionally done as it is our opinion that Oracle hopes that the prospect will miss the onerous terms of the SSA altogether, which are buried in a disguised hyperlink.  And even if the prospect does click on the grayed out and barely discernable hyperlink, the link does not take the reader right to the document.  Instead, the prospect is forced to click through several confusing pages on Oracle’s website to locate the SSA. 

The documents that Oracle eventually presents via a DocuSign do not include a PDF of the SSA. Instead, the documents are often presented to the customer in a pressured environment where the Oracle sales team says that if the documents are not executed immediately, the steep discounts will go away.  

Many NetSuite SuiteSuccess customers do not have legal counsel to review and advise them on the contract.  Instead, they succumb to the highly orchestrated pressure campaign and sign the documents without proper vetting.  At that point Oracle has them, because Oracle now has the many protections of the lopsided agreement, which we explain in more detail below.

1. Disclaimer of Warranties

The SSA includes a section that disclaims many types of warranties, including those involving third-party applications and services. Oracle does not guarantee that its services will be error-free or uninterrupted and explicitly states that it is not responsible for issues caused by third-party applications. (SSA ¶9).

This limits Oracle's liability, especially in complex cloud environments where multiple third-party vendors are involved. For example, if a third-party contractor recommended by Oracle causes issues with the service, Oracle can claim it bears no responsibility.

2. Limitation of Liability

Oracle limits its liability significantly in the SSA.( SSA ¶10)  According to the agreement, Oracle will not be liable for indirect, consequential, or special damages, and the total liability is capped at the amount paid by the customer in the last twelve months. This means that even in the event of a major issue, the customer cannot recover losses beyond the value of their most recent subscription fees.

This provision is a major risk for customers, especially if they experience business interruptions or data breaches caused by Oracle's services. Limiting damages to the subscription fee amount offers minimal financial recourse for the customer.

​The limitation of liability is one of the most favorable provisions for Oracle, which caps Oracle’s responsibility at the amount of fees paid by the customer within the past 12 months. For a large corporation like Oracle, this minimal liability offers substantial protection, even in cases of significant service failure. In contrast, customers are exposed to greater risk, particularly in cases where service failures lead to business losses far exceeding the capped liability.

3. Responsibility for Third-Party Applications

Oracle disclaims any responsibility for third-party applications or implementation partners, even where these were recommended by Oracle. SSA ¶¶ 6.5, 14.2.3. The agreement emphasizes that Oracle is not liable for data loss, errors, or interruptions caused by third-party applications, even if they are listed in the SuiteApp marketplace or are recommended by Oracle.  Likewise, the SSA provides that Oracle is not liable for deficient work of Oracle implementation partners, even where Oracle recommended them in the first place.

This limits Oracle’s exposure to liability when issues arise from third-party software or services, even if these services are crucial for the ERP solution to function. Customers are left responsible for the risks associated with such third-party tools or third party Oracle partners.

​4. Termination and Suspension Provisions

Oracle reserves the right to suspend services if the customer’s account becomes delinquent or if it believes there is a significant threat to the functionality, security, or integrity of the services. SSA ¶7.  This provision gives Oracle broad discretion to suspend services without bearing liability for interruptions caused by these suspensions.

While this protects Oracle's interests in maintaining secure services, it leaves customers vulnerable to sudden service interruptions that could impact their business operations. This provision lacks balance in protecting the customer’s need for operational continuity.

A close analysis of the termination provision in Oracle’s SSA reveals that the agreement can only be terminated by the customer for cause, not for convenience. This means that a customer can only end the agreement if Oracle materially breaches the contract and fails to remedy the breach within 30 days after receiving written notice. (SSA ¶7.3). While this provision might appear bilateral at first glance, since both parties have the right to terminate for cause, it actually benefits Oracle more. The reason is that customers are locked into the contract for its full term, regardless of changes in their business needs or satisfaction with Oracle’s services. Oracle, however, can terminate the contract if the customer breaches any material term, such as payment delinquency, which gives Oracle more leverage in enforcing the contract.  And as mentioned above, it has the power to suspend the services.

Moreover, the agreement includes automatic renewal provisions, where the subscription will renew for an additional year unless the customer provides written notice of non-renewal at least 30 days before the expiration of the current term. (SSA 4.A). This ensures Oracle retains long-term contractual commitments, as customers must actively manage the renewal process to avoid being automatically bound by another term.

The provision primarily benefits Oracle by locking customers into the agreement unless there’s a breach, while also ensuring automatic renewals unless the customer is proactive
​in canceling.

5. Confidentiality and Security

Although Oracle claims to protect Customer Data with reasonable safeguards, the agreement places the burden on customers to ensure the accuracy, legality, and reliability of their data. This leaves the customer responsible for many aspects of data integrity and security, which is crucial in cloud environments where sensitive information is stored. (SSA ¶8).

​While Oracle commits to basic security measures, this provision helps shield Oracle from liability if the customer's data is compromised. (SSA ¶6.10)

6. No Warranties for Performance

The SSA provides that Oracle does not guarantee that all service issues will be fixed or that its services will meet customer expectations. (SSA ¶9(b)). 

This is particularly risky for businesses that depend on Oracle’s services for mission-critical operations. If the cloud ERP solution underperforms or causes delays, Oracle’s limited warranties and liability protection leave customers with little recourse.

7. Integration Clause Seeks to Bar Oral Discussions Pre-Contract

The integration clause in Oracle’s SSA could be used against the customer by limiting the customer's ability to rely on any promises, statements, or agreements that are not explicitly included in the contract. This clause typically states that the agreement constitutes the entire understanding between the parties and supersedes all prior discussions, negotiations, or other agreements, whether written or oral (SSA ¶14.1).
Oracle could use this clause to its advantage in several ways:
1.    Prevents reliance on prior representations: If Oracle’s sales team made specific promises about the performance, capabilities, or features of the service that are not expressly included in the SSA, Oracle will argue that the customer cannot later claim these promises as part of the contract. For instance, if Oracle's representatives verbally assured the customer of certain included functionality, but those terms are not in the written agreement, Oracle can argue that such assurances are not enforceable.
2.    Limits modifications to written amendments: The clause stipulates that any changes to the agreement must be made in writing and signed by both parties. This means that even if Oracle’s representatives agree to make certain accommodations or offer concessions during the course of service, those will not be binding unless they are formally documented.
3.    Nullifies external documents: Oracle could reject any attempt by the customer to rely on external materials such as marketing brochures, proposals, or emails as part of the contractual obligations, arguing that the integration clause bars the inclusion of any terms or representations outside the SSA.
In essence, Oracle could use the integration clause to solidify that only the specific terms written in the contract are binding, eliminating the possibility of the customer introducing external agreements or promises in case of a dispute. This can work strongly in Oracle’s favor, especially if the customer was led to believe certain non-contractual assurances would apply. 

8.  Why the SSA Should Never Be Hidden in Hyperlinks

An agreement like the SSA should never be hidden behind a disguised hyperlink in an estimate form for several reasons:
1.    Transparency and Fairness: Hiding critical legal terms makes it difficult for customers to fully understand the terms they are agreeing to. This undermines transparency and could lead to customers unknowingly accepting provisions that are not in their best interest.
2.    Informed Decision Making: The SSA contains clauses that significantly affect the customer’s legal rights and liabilities. If these terms are hidden, it prevents customers from making informed decisions based on the true scope of their risk.  In other words, the customer will be taking on risk but it won’t even know of the risk.  This flies in the face of the requirement that there must be a “meeting of the minds” in order for a binding contract to be formed.
3.    Potential for Disputes: A hidden SSA can lead to future legal disputes, as customers may claim they were unaware of the provisions. Making such a critical document accessible only through obscure hypelinks could be seen as an attempt to downplay or obfuscate important terms.  For example, if Oracle customers don’t know of the SSA then they don’t know about the requirement for a written notice of breach and a mandatory cure period of 30-days.  That is why when the customer approaches Oracle it usually asks to “cancel” the contract, not understanding that there are certain requirements that must be met to terminate.  Oracle usually responds that the contract cannot be “cancelled”, neglecting to provide the customer with a copy of the SSA and the termination provision, which allows for termination for material breach and a failure to cure.
4.    Industry Best Practices: It is a best practice to present all critical agreements directly to customers for review before they sign any contractual forms. This builds trust and ensures that all parties are clear on the terms from the outset.

​In conclusion, Oracle’s Subscription Services Agreement is designed to limit its liability and protect its interests, often at the expense of the customer. From disclaimers about third-party applications to limitations on termination rights and automatic renewals, the contract places significant responsibility on the customer while minimizing Oracle’s exposure. Provisions like the integration clause further strengthen Oracle’s position by ensuring only the written terms are enforceable, leaving customers with little recourse for any external promises unless they can meet the heavy burden of proving fraud in the inducement. This highlights the importance of thoroughly understanding the terms of such agreements and ensuring they are presented transparently, not hidden behind hyperlinks.  


0 Comments
<<Previous

    By Tactical Law Attorneys and From Time to Time Their Guests
    ​

    The contents of this blog is intended to convey general information.  It should not be relied upon as legal advice.  It is not an offer to represent you nor is it intended to create an attorney-client relationship.  Tactical Law does not sponsor, endorse, verify or warrant the accuracy of the information contained on internal sites or subsequent links.

    Picture

    Authors

    Collectively we have practiced law in California for over 60 years.  Our attorneys have advised clients of all sizes across industries on how to favorably resolve software audits, licensing and other disputes with Oracle/NetSuite and other software companies.

    Archives

    November 2025
    September 2025
    July 2025
    April 2025
    December 2024
    October 2024
    September 2024
    June 2024
    April 2024
    February 2024
    December 2023
    September 2023
    July 2023
    June 2023
    May 2023
    April 2023
    March 2023
    January 2023
    December 2022
    November 2022
    October 2022
    September 2022
    August 2022
    July 2022
    June 2022
    May 2022
    April 2022
    March 2022
    December 2021
    July 2021
    May 2021
    March 2021
    February 2021
    October 2020
    September 2020
    August 2020
    July 2020
    June 2020
    May 2020
    April 2020
    January 2020
    December 2019
    November 2019
    July 2019
    June 2019
    May 2019
    April 2019
    March 2019
    February 2019
    January 2019
    December 2018
    August 2018
    July 2017
    January 2016

    Categories

    All

    RSS Feed

tactical law group llp

Privacy Policy
Terms of Use
Contact

 COPYRIGHT TACTICAL LAW GROUP LLP 2016-20235   ALL RIGHTS RESERVED
​ 
Legal Disclaimer:  Contents may contain attorney advertising under the laws of some states.  Prior results do not guarantee a similar outcome.
  • Home
  • Professionals
    • Pamela K. Fulmer
    • Dee A. Ware
    • Julie Bishop
    • Affiliated Counsel
  • Practice
    • Software Audit Defense
    • Licensing & Contract Disputes
    • Litigation
    • ERP Licensing & Disputes >
      • Oracle/NetSuite Disputes >
        • River Supply v. Oracle/NetSuite
    • Advertising and Competition
    • Trade Secrets & Employee Mobility
    • Intellectual Property
    • Arts & Entertainment
    • Tech Transactions
    • Outside General Counsel Services
    • Privacy and Data Security
  • Industries
  • Resources
  • About us
  • Oracle Blog
  • Tactical Law Blog
  • Contact