Firstly, with regards to embedded digital content, there is the possibility within the DCD proposal that only goods rules apply while digital content rules do not (option 1). It is noteworthy that there is no express provision on delimiting the scope of application of DCD and goods rules in the Articles of the DCD. The delimitation rule is somewhat concealed in recital 11 DCD, which states that: “this Directive should not apply to digital content which is embedded in goods in such a way that it operates as an integral part of the goods and its functions are subordinate to the main functionalities of the goods.” [12] A comparable rule is provided in recital 13 OSD. [13]

Thus, a general rule according to the current proposals for DCD and OSD is that if (i) digital content operates as an integral part of the goods and (ii) its functions are subordinate to the main functionalities of the good, then the good falls within the field of application of the rules on goods, not the rules on digital content. This means that for the majority of smart goods – such as connected cars, smartphones, smartwatches, SmartTVs and smart kitchen appliances – only national consumer sales rules harmonised by the OSD and CSD will apply. [14] Staudenmayer calls this a pragmatic approach, which should ensure that these provisions are future-proof; using the example of software integrated in a washing machine whereby such software contributes to washing the clothes, it falls within the scope of goods rules. [15] Likewise, upon purchase of a laptop or a smartphone, the goods rules would apply to both the laptop or phone hardware and the operating system because the operating system is an integral part of the good and subordinate to its main functionalities. [16] On the other hand, for instance MS Office installed to a computer as an add-on, or an app downloaded to a smartphone would be subject only to the rules of DCD as such software is not subordinated to the main functionalities of the laptop or smartphone and is thus not covered by the definition of embedded content of the DCD-proposal.

Central to option 1 is the question of what constitutes embedded digital content, as goods rules apply to embedded digital content only and not to other types of digital content. The definition of embedded digital content thus determines the amount of software in a smartphone or some other smart good to which goods rules apply. In connection with the definition of embedded digital content proposed by the Commission, the main problem lies in interpreting the notion of “subordinate to the main functionalities of the good”. What to consider the main function of e.g. a smartphone can vary significantly among different consumers and probably also over time. By way of illustration, my mother uses the phone mainly for making calls, whereas my teenage daughter uses a phone for apps and accessing the internet, and instead of making calls she prefers messaging her friends on social networking sites and apps. This simple example alone shows that there is no uniform average consumer’s understanding of what constitutes the main functionality of a smartphone. To give another example, an autonomous driving software of a car clearly constitutes a main functionality of a self-driving car. “Normal” navigation software, on the other hand, cannot be regarded as main functionality of a car as a car can be driven without it. Therefore, it would fall under the DCD. From the software producer’s as well as from the consumer’s point of view, however, it is very hard to understand why a navigation software of a normal car should fall within the scope of DCD whereas navigation software, which is part of an autonomous driving software, falls under goods rules. Furthermore, a definition of an embedded digital content that requires it to be “an integral part of the good” might not be future-proof, as it is – or may become – technically possible to run crucial software such as operational software on the cloud rather than embedding it into the smart good.

Wendehorst has put forward an alternative definition of embedded digital content that avoids using the criterion of “subordinate to the main functionalities of the good”. She suggests to define embedded digital content as “digital content which has been installed by or with the assent of the seller, producer or another person in the chain of transactions and which (i) operates as an integral part of the goods and cannot easily be de-installed by the average consumer using this type of goods; or (ii) is necessary for the conformity of the goods with the contract”. [17] Thus, for software to be embedded digital content, it needs to be installed into the good by one or another authorised person. Second, such software should either be an “integral part” of the goods, which cannot easily be de-installed by the average consumer, [18] or necessary for the conformity of the goods with the contract.

This definition is, on the one hand, more future-proof, as it avoids the ambiguous concept of “subordination to the main functionalities of the good”. On the other hand, it introduces a new concept, that of “necessary for the conformity of the goods with the contract” which, combined with the criterion of installation, enables digital content placed outside of a good to also be regarded as embedded digital content. An example could be a digital bracelet for tracking fitness-related metrics, with the necessary software running “in the cloud”. [19] Following this definition, goods rules would cover even more digital content than according to the Commission proposal. However, this definition was not suggested as an amendment to the DCD proposal but to the OSD proposal, that is, for the “digitalisation” of sales law. Taking into account that the “digitalisation” of sales law on the EU level is politically improbable now, [20] this definition of embedded digital content is not usable for the DCD proposal as it currently stands – and was not proposed as such. If one wants to stick to option 1, a workable definition might be the slightly modified one defining embedded software as pre-installed digital content, which operates as an integral part of the goods and cannot easily be de-installed by the consumer. [21]

The example of fitness bracelet used above also illustrates the problems concerning demarcation of embedded digital content and mixed contracts (Art. 3(6) DCD). Article 3(6) DCD states: “Where a contract includes elements in addition to the supply of digital content, this Directive shall only apply to the obligations and remedies of the parties as supplier and consumer of the digital content.” Thus, in the case of a mixed contract, the part of the contract concerning digital content is covered by DCD, whereas the remaining parts of the contract are governed by the rules on the respective type of contract. This means that if a smart good is supplied together with a separate digital content, the supply of that separate digital content will fall under the DCD. [22] For example, if the supplier of a fitness bracelet sells under the same contract, both the bracelet (a good) and software (an app) which is located separately but necessary to use the bracelet, this is a mixed contract according to Art. 3(6) DCD with the consequence that goods rules apply to the bracelet and DCD rules apply to the app.

This in turn raises the legal policy question regarding why goods rules should apply to embedded digital content while DCD applies to apps or other software not integrated into the good but equally necessary to use the good. [23] Furthermore, drawing a line between embedded digital content and mixed contracts may become very difficult for example in a situation such as where a consumer buys a car with an in-built satellite navigation system including maps which are regularly updated via the internet. [24] Is this a case of embedded software (meaning that rules on goods apply to the car, navigation software and maps) or mixed contract (meaning that rules on goods apply to the car, possibly also to the navigation software, while maps are covered by the rules on digital content)?  [25] One should probably assume that built-in navigation software is not an embedded digital content at all, as strictly speaking navigation guidance is not “subordinate to the main functionalities of the car.” And whether and why would the situation be different when additional maps or added functions of navigation software are activated only later at separate cost and possibly under separate agreement? [26] These examples show one of the main weaknesses of option 1: any definition of embedded digital content would run into problems with demarcation of embedded digital content and mixed contracts, and hence the legal policy questions concerning the applicability of one or another legal regime to a substantially similar situation.

Under option 2, the rules of DCD would apply to any digital content, including embedded digital content, while hardware would be subject to the rules on goods. [27] Accordingly, as regards for instance smartphones, rules on goods would only apply to hardware, whereas anything else (OS [operating system], pre-installed apps or apps installed later) would fall under rules on digital content. In option 2, definition of embedded digital content is irrelevant, as nothing depends on this: goods are covered by goods rules, digital content (either embedded or not) is covered by digital content rules. If one chooses option 2, problems will rather arise upon identifying the origin of defects of smart goods, as sometimes it can be very burdensome to find out whether a smart TV is not working due to a problem with hardware or software.

Another question that arises in connection with option 2 is which are the provisions to rely upon e.g. for terminating a smart good contract or reducing the price if only one component (hardware or software) is non-conforming. In case of non-conforming integrated software (such as the OS of a smartphone), it is impossible to terminate the contract partially that is only regarding the embedded software. Rather, the consumer would prefer to return the entire phone should repair of the non-conformity of the OS fail. Similar problems arise as to other remedies the consumer might want to exercise against the trader. Therefore, when choosing option 2, rules on goods should additionally provide that any non-conformity of the embedded digital content also mean non-conformity of the goods. [28] This is the solution used in Section 16 of the UK Consumer Rights Act 2015. [29] It is important to stress that only the non-conformity of embedded digital content would bring about the non-conformity of the entire good: the responsibility for apps or other software that are later installed by the consumer lies with their supplier and their defects do not bring about non-conformity of the smartphone.

To solve problems arising under option 2, the ELI has proposed in its Statement the following rule: “The consumer should be entitled to /…/ exercise the appropriate rights under sale of goods law, but she could equally choose to make a claim on the basis that the problem lies in the digital content, in which case the consumer should be entitled to proceed under the DCD. If the consumer claims that the problem lies in the digital content the burden of proof that the problem really lies in the hardware should be on the supplier.” [30] Here, a consumer is allowed to choose which rules – either those on goods or those on digital content – to rely upon according to the source of non-conformity as identified by the consumer. A positive aspect of this solution is that the burden of proof as regards the source of non-conformity is imposed on the trader; namely, the trader can for instance, prove that the smartphone is not working due to a mechanical defect of its case and not due to a software failure. The author is nevertheless of the opinion that DCD should also not apply where it is obvious from the nature of the goods or from the nature of the lack of conformity that the lack of conformity lies in the hardware of the good. This would preclude odd situations where, say, a brand-new vacuum cleaner containing a limited amount of embedded digital content would be expected to fall under the rules of digital content although the obvious reason why it does not function is not a software problem but a clog in the hose. Further, it is important that under option 2 not only the DCD provisions on the remedies of the consumer would be applicable to embedded digital content. As will be shown below, other provisions of DCD are also relevant for embedded digital content.

As a modified option 2, it is suggested to apply the DCD rules to the whole smart good (including embedded digital content) unless the trader proves that the defect lies within the hardware. [31] This would mean that as a rule, DCD would apply both to hardware and to software of the smart good. Choosing this solution would mean that in the future, selling and leasing of a considerable amount of consumer goods would underlie DCD as more and more goods are containing some kind of digital content. In order to avoid inconsistencies and unwanted consequences, one should then make clear that certain domestic or European goods rules remain applicable instead or in addition to the DCD. For example, the seller of a smart product must not only make available the embedded digital content (Art. 5 DCD), but also hand over the good itself. Similarly, Art. 20 CRD [32] must be applicable to the smart good, as the DCD does not contain rules on passing of risk.

Unlike the CSD and OSD, Art. 3 (1) DCD provides that the consumer’s counter-performance may take the form of active provision of his or her personal data or any other data. In other words, active provision of personal or other data by the consumer triggers the application of DCD and makes available the remedies provided therein against the trader. This is an innovative provision [33] up-to-date with market reality and such a concept has not been used before in EU consumer or other contract law. Neither CSD nor OSD treat data as counter-performance and this concept is unknown in the national laws of the Member States. [34]

Therefore, under option 1 (only goods rules to smart goods) data provided to the trader by the consumer cannot be considered as payment and depending on whether the consumer makes any monetary payments for such good or not, the contract is governed by the rules on sales contracts or those on gratuitous contracts. This outcome is questionable from the legal policy perspective if the software integrated in the good which the trader presents as a “gift” to the consumer on promotional purposes later, enables the trader to gather commercially valuable data on the consumer. In that case, the consumer essentially pays for a “free” product in the same way as is paid for the “free” Facebook, for instance. This consequence is rendered unfair by the fact that depending on national law, the trader would be able to rely on the restricted liability of the donor where the provisions regarding gratuitous contracts apply. For example, according to Estonian law, the donor is generally held liable for the lack of conformity only in the case of intention or gross negligence (Subsection 264 (2) of the Law of Obligations Act). [35] Therefore in many cases, the consumer would have no remedies against the trader.

Under option 2 (DCD rules apply to digital content), the supplier would not be able to rely on the regime of gratuitous contract and its possible liability restrictions. It would be possible to consider at least the embedded software as received for counter-performance and the consumer would thus be able to rely on the provisions of DCD on legal remedies. The consumer could for instance request repair of the smart good or in certain cases terminate the contract and demand that his or her personal data or user-generated content were no longer used or returned (Art. 12 (3) and (5) and Art. 13 (2) DCD).

A significant difference between DCD and OCD proposals and CSD concerns the conformity criteria of the contract object. While Art. 2 (2) CSD and Articles 4 and 5 OCD are combining the subjective and the objective criteria, the wording of Art. 6 DCD indicates the prevalence of the subjective standard, that is, the characteristics of the digital content that have been agreed upon by the parties. This approach has been repeatedly criticised for reducing the level of consumer protection and leaving the consumer at the mercy of the supplier’s standard terms and product information. [36]

For example, under Art. 2 (2) CSD, a car has to show the quality and performance that are normal in goods of the same type and which the consumer can reasonably expect. This does not apply only if at the time the contract was concluded, the consumer was aware, or could not reasonably be unaware of, the lack of conformity (Art. 2 (3) CSD). A similar rule has been set out in Art. 5 (a) and (c) OSD. Under option 1, the conformity of embedded digital content would also be tested according to these provisions, this is under a combined objective and subjective test. Under option 2 however, digital content such as the operating system of a smartphone of anti-lock brake software of a car should be just as required by the contract (Art. 6 (1) DCD), even if the quality as described in the contract is below average. The latter, though, holds on the condition that the corresponding contract term is transparent.

As in terms of conformity criteria, the goods rules provide for higher consumer protection levels than the rules on digital content, it seems that consumers would benefit more from option 1 as only the goods rules would apply to a connected car and its integrated software. Nevertheless, the critics point out that the minimum standards required for digital content (e.g. functionality and interoperability) under Art. 6 (1) (a) DCD will in this case not apply to embedded digital content leading to a serious gap in consumer protection. [37] This could in turn be challenged by saying that both functionality and interoperability can be subsumed under the objective standard of the purpose and quality of a smart good. For example, in the German legal literature and case law, it is held that where software is sold together with a computer, the hardware must be suitable for running that software, and the use of the software must not be hindered by any technical barriers overcoming of which would require cooperation with the software producer. Otherwise, the computer as a good would lack conformity with the contract. [38]

The same applies to (cyber)security as a criterion of conformity with the contract. Article 6 (1) (a) DCD clearly states that security of the digital content is a part of conformity with the contract. So, if the rules of digital content were to apply, a smart fridge which can easily be hacked due to security holes in its software would also clearly lack conformity to the contract – notwithstanding if the fridge was sold or rented. The rules on goods – which would be applicable to the embedded software of a smart fridge under option 1 – do not expressly refer to security as a conformity criterion. Nevertheless, it could be quite easy to achieve by way of interpretation that security problems of embedded software constitute non-conformity of a smart good, for instance, where the embedded software of a smart baby monitor or smart home system makes it susceptible to hackers. [39] Indeed, the need for an internet-connected good to conform to the normally expected level of internet security in order to meet the objective conformity standard of the good is easily justifiable.

If DCD sticks to the subjective conformity criteria, option 2 (DCD rules apply to embedded digital content) would in the author’s view clearly mean lowering the consumer protection level in comparison to option 1. In that case, for instance a smartphone seller could apply the “as is” clause also to the operating system of the smartphone or the in-built software of a washing machine, on the condition that this is transparently stated in standard conditions. Yet, if the opinions of legal scholars and consumer protection stakeholders are heard during the further legislative process of the DCD-proposal, and the combination of subjective and objective criteria is accepted, the choice between options 1 and 2 is not of critical importance any longer.

Art. 3 (1) CSD, Art. 10 DCD, and Art 8 (1) OCD all build on the principle that the seller or supplier is responsible only for the lack of conformity which existed at the moment of delivery. All of these directives also set out time-limits within which the burden of proof is reversed in favour of the consumer. The length of these periods varies, however. Art. 5 (3) CSD provides that any lack of conformity which becomes apparent within six months of delivery of the goods is presumed to have existed at the time of delivery unless this presumption is incompatible with the nature of the goods or the nature of the lack of conformity. To put it otherwise, CSD is based on the rule that a lack of conformity which became evident within the first six months was presumably existing at the time of delivery of the good and this triggers the liability of the seller. [40] Art. 8 (3) OCD extends this period for 2 years, whereas Art. 9 (1) DCD for an indefinite period. To be more precise, DCD establishes a reversed rule whereby the burden of proof with respect to the conformity is always on the supplier. [41]

Where a lack of conformity of the OS of a smartphone or a problem with the washing-machine software manifests in the eighth month of usage, under option 1 it would be for the consumer to establish that the phone or the machine (i.e. the software embedded with it) was non-conforming already upon its delivery. [42] It is obvious that this would be very burdensome for the consumer. [43] The same problem arises in case of smart TVs, smart fridges and other connected goods.

Under option 2, the consumer could rely on the provisions of the DCD. This means that if a software bug makes its first appearance in the eighth month of usage, the supplier would still have to prove that the software was in conformity with the contract at the time the car or mobile phone was delivered. If the trader fails to do so, the consumer is entitled to use remedies, e.g., to demand repair. This result would obviously be more favourable for the consumer than option 1 whereby the consumer, in order to be entitled to use a remedy, has to prove that the software of a car or a smartphone was lacking conformity already at the time of delivery. However, there could be a situation where the embedded software becomes infected with malware only after the software has been supplied to the consumer. In such a case, the supplier is liable only if considered to have provided guarantee for the product or if there exists an additional contractual obligation covering software updates and supplements.

More complex cases arise where it is unclear whether the cause of a non-conformity lies in software or hardware. For instance, a smart TV does not turn on or “crashes” in its tenth month of usage; is it for the consumer to supply evidence that the TV hardware was lacking conformity at the time of supply, or is it for the supplier to prove that the embedded software was conforming to the requirements when supplied? Under option 1 the burden of proof lies within the consumer: in the absence of commercial guarantee, (s)he has to prove that the TV or software embedded within it was non-conforming already at the time of delivery. Under option 2, the burden of proof regarding the embedded software lies with the supplier. Here, the European Law Institute rightly has proposed an additional rule whereby the supplier can prove that the cause of non-conformity lies in hardware; [44] if that is the case, then goods rules (CSD, OSD) apply. In that case, the consumer would be able to make a claim against the supplier of the TV arguing that as the fault is presumably in software [45] and was presumably there already at the time of delivery of the TV, (s)he is entitled to use a remedy - for instance, demand the supplier to fix the OS of the smart TV. [46]

In practice, the question of whether the digital content was lacking conformity at the time of delivery or not is generally one for an expert. Therefore, rules on the burden of proof are of significance also for questions such as who must pay the costs of expertise if it appears that the lack of conformity did not exist at the time of delivery but had causes brought about by the consumer. If a lack of conformity becomes apparent during the period within which the burden of proof is reversed in favour of the consumer, the supplier is required, at least under Estonian law, to pay the costs of expertise even if the non-conformity was caused by the consumer. [47] It is unclear whether this question is a matter of national law or not. On the one hand, it might be argued that the costs of expert reports are a specific case of compensation for damages which is not governed by the directives and falls thus within the scope of national law. On the other hand, the question could also be regarded as lying within the scope of application of the directive(s). Namely, if the national law would be able to provide that expertise costs would in any case be borne by the consumer, then the consumer would not be entitled to repair of the smart good free of charge if it turns out that the good was in fact non-conforming already at the delivery stage. [48]

Finally, it should be noted that the application of paragraphs (2) and (3) of Art. 9 DCD to embedded digital content would be justified as these provisions better reflect the specificity of digital content by requiring the consumer to cooperate with the supplier to establish the lack of conformity, i.e. to assess the consumer's digital environment. This again supports application of option 2 over option 1.

According to Art. 5 (1) CSD, the consumer can pursue a remedy for a non-conformity that becomes apparent within two years from delivery. As CSD is a directive based on minimum harmonisation, setting out such time-limit is not obligatory for the Member States and not all Member States have done this. [49] Art. 14 OSD similarly provides that the consumer is entitled to a remedy for the lack of conformity with the contract of the goods where the lack of conformity becomes apparent within two years. However, as OSD is based on maximum harmonisation, the Member States cannot provide a more favourable regime for the consumers. According to the current version of DCD, there is no time limit for the supplier’s liability [50] because the digital content is not subject to wear and tear like “normal” goods. [51] The duration of the liability of a supplier of digital content is determined by national prescription periods. [52] Likewise, the liability of a lessor of a good with embedded digital content (for instance a connected car or tablet computer) depends on national prescription periods, as this matter has not been harmonised by EU rules.

As regards embedded digital content, option 1 would mean that the consumer would generally be able to seek remedy against the trader under the rules on goods, that is, on the condition that the lack of conformity of the digital content became apparent within two years as from the delivery of the good (Art. 5 (1) CSD, Art. 14 OCD). After the expiry of this two-year guarantee period there would only remain a theoretical possibility for the consumer to claim against the producer of the digital content if such possibility is provided for the consumer in national law. In the absence of a legal relationship (producer's guarantee) between the consumer and the producer of digital content, the consumer is not entitled to repair of the digital content after the 2 years have elapsed.

Under option 2 the consumer could file claims related to, for instance, physical faults of a connected car according to rules on goods; that is on the presumption that the lack of conformity became apparent within two years. As regards defective embedded digital content, such as anti-lock brake software, the consumer could use remedies until the end of the national prescription period. Thus, a seller (or a lessor) of a car should take into account that the duration of his liability for the digital content embedded with the car can be longer (or shorter, as the case may be) than that for the car.

As for products with integrated software, the central question is whether the consumer can resort to remedies under rules on goods or those on digital content. It is important to understand that while in the case of certain remedies such as repair or compensation for damages it would be possible, in theory, to use a remedy under rules of goods for the goods component and a remedy under the DCD for the digital content component of a product, the remedies of price reduction and termination of the contract can only be applied to the good as a whole and not just to malfunctioning software or defective hardware. Therefore at least in the case of these remedies, relying on either one or the other of the two regimes would be feasible, but not combining both. For this reason, it has rightly been suggested that if option 2 was to apply, the consumer should be entitled to choose which regime to rely on while the trader could avoid the application of the chosen regime by establishing that the defect lies with the other component of the smart good. [53]

Under option 1, the consumer could resort to remedies provided in the CSD and OSD. Thus, according to the principle of the hierarchy of remedies, the consumer should first give the seller an opportunity to cure the non-conformity of a smart good and only resort to price reduction or termination of the contract as a second option. [54] Preconditions for termination depend on the regime being applied: under Art. 3 (6) CSD, the lack of conformity must not be minor, whereas Art. 9 (3) OSD permits termination of the contract for whatever lack of conformity. [55] Termination of contract in case of leased goods would be possible according to the provisions of national law. The provisions of the DCD would have no significance under option 1 and in a particular case, the decisive question would be if and under which circumstances a defective embedded software or, for instance, its incompatibility means lack of conformity of the good as a whole, and if and under which circumstances this constitutes a minor non-conformity. For instance, is the monthly crashing of the OS of a tablet computer or of a smart TV a minor lack of conformity in respect of the good as a whole?

Under option 2, the consumer could rely on the remedies of the DCD. While the principle of hierarchy of remedies applies also according to Art. 12 (3) DCD, and the price reduction rules do not differ considerably from those provided for the sale of goods, the termination provisions of DCD contain several specific rules regarding both the grounds for and effects of termination. According to Art. 12 (5) DCD, the consumer may terminate the contract only if the lack of conformity with the contract impairs functionality, interoperability and other main performance features of the digital content such as its accessibility, continuity and security. [56] The advantage of such rule is in clearly binding the right to termination to the effect of the lack of conformity on the specific performance features of the digital content such as interoperability, continuity or security. Furthermore, under these circumstances the consumer is protected also by the second sentence of Art. 12 (5) DCD, according to which the burden of proof that the lack of conformity with the contract does not impair functionality, interoperability and other main performance features of the digital content shall be on the supplier. Thus, option 2 is adequately reflecting the particular features of digital content while also being more favourable for the consumer. On the other hand, under option 2, Art. 13 (3), the DCD would also be protecting the suppliers, allowing them to terminate a sales contract of a connected car and also to disable the user account of the consumer. [57]

Ultimately, the application to digital content of one or the other set of rules also determines whether the specific data provisions of the DCD will be applied; in particular, the rules concerning the effects of termination in relation to consumer data provided to the supplier (Art. 13 (b) and (c) DCD). These provisions would not be applicable under option 1. It has already been claimed that such a result would lead to a serious gap in consumer protection. [62] Nevertheless, a consumer who has purchased or leased a smart good (a data subject according to General Data Protection Regulation, GDPR [63]) would preserve the rights given by the GDPR even if provisions on digital content are not applied, and the European Data Protection Supervisor has already warned that two parallel regimes could create legal confusion. [64]