Fortinet
Information Technology
56
out of 100. Number 161 of 512, counting from the worst.
Where Fortinet does well
- Fortinet's Service Offering Terms state plainly that 'Service Contracts are for a set duration and do not autorenew' (per third-party mirror of the Fortinet Service Offering Terms v3.8), which is better than the consumer-style auto-renew traps that plague peers.
- The site honors the Global Privacy Control signal, treating GPC-enabled browsers as opted out of CCPA-defined 'sale' or 'sharing' via cookies.
- The privacy policy publishes an unusually detailed category-by-category chart of exactly what personal data is disclosed to which categories of third parties.
- Fortinet is Data Privacy Framework certified (EU-U.S. and Swiss-U.S.
- DPF), and the EULA gives customers a 5-calendar-day window after receipt to contact Fortinet Legal with requested changes instead of accepting the license.
Fortinet can change your license terms unilaterally just by posting a new version.
The fine print
6 clauses and findings from the draft archive, dated 1 October 2026. The plain English comes first; the small print is the company's own words. None of these has been checked yet.
-
Fortinet can change your license terms unilaterally just by posting a new version. You never sign anything new — installing an update counts as agreeing to whatever they published.
USE OR INSTALLATION OF FORTINET PRODUCT(S) ... CONSTITUTES ACCEPTANCE BY END USER OF THE TERMS IN THIS AGREEMENT, AS AMENDED OR UPDATED FROM TIME TO TIME IN FORTINET'S DISCRETION BY FORTINET PUBLISHING AN AMENDED OR UPDATED VERSION.
Fortinet Product License Agreement / EULA and Warranty Terms (February 2025)
-
If you fight Fortinet over a product dispute, you can't sue in your home court — it's binding arbitration under JAMS rules in Santa Clara County, California, wherever you bought the product.
Any disputes arising from or relating to this Agreement ... that cannot be amicably settled by and between the parties shall be referred to and finally resolved by arbitration. The place of arbitration shall be Santa Clara County, California, pursuant to the Streamlined Arbitration Rules and Procedures of Judicial Arbitration and Mediation Services (JAMS)...
-
Fortinet openly admits it shares your IP address, browsing activity on Fortinet.com, and purchase-interest data with marketing and analytics companies — activity California law treats as a 'sale' of your data — and says this continues today.
During the 12 months leading up to the effective date of this Privacy Policy, we have 'sold' and 'shared' (as those terms are defined under the CCPA) what the CCPA calls 'identifiers' (like IP addresses), 'internet or other electronic network activity information' ... and 'commercial information' ... to third parties that assist us, such as marketing providers and analytics providers. This practice continues today.
-
Fortinet sets no fixed deletion timeline — your data stays until Fortinet itself decides it no longer needs it, and backups can linger even longer than the originals.
We will retain your information until after we determine that retention of it no longer is necessary to fulfill the relevant purposes outlined in this Privacy Policy or a legal requirement... we make backups of certain data, which we may retain for longer than the original data.
Fortinet Privacy Policy (effective September 15, 2025), Data Retention
-
If you don't register your paid service contract in time, Fortinet starts (and eats through) your paid service term automatically — and unused professional services or training contracts are forfeited entirely with no refund.
For non-hardware-attached Service Contracts, the Customer will receive a Grace Period of 60 days in all regions. On the date the Grace Period expires, and in the absence of an applicable registration event, the Service Contract will automatically start. ... The service entitlement covered by the Professional Service or Training contract will be forfeited without any right to obtain a refund.
-
Even Fortinet's own website content is locked down: simply by visiting, you accept that you can't republish, quote, or repurpose their materials for any public or commercial purpose.
Fortinet hereby authorizes you to copy materials published by Fortinet on this Web Site solely for non-commercial use within your organization... Except as specifically permitted herein, no portion of the information on this web site may be reproduced in any form, or by any means, without prior written permission from Fortinet.
How these were found
Documents read via browser_open on 2026-10-01: Fortinet Privacy Policy (effective date September 15, 2025) at https://www.fortinet.com/corporate/about-us/privacy; Fortinet Product License Agreement / EULA and Warranty Terms (February 2025 version, marked 'Contents and Terms Are Subject to Change by Fortinet Without Prior Notice') at https://ftnt-eula.s3.us-east-1.amazonaws.com/EULA.pdf; Legal | Rules and Regulations | Terms & Conditions at http://www.fortinet.com/corporate/about-us/legal; Service Contract Activation and Grace Period Policy at https://www.fortinet.com/corporate/about-us/legal/service-contract-activation-grace-period-policy. The 'Service Contracts ... do not autorenew' statement was read from a third-party mirror (Fortinet Service Offering Terms v3.8 hosted at boll.ch) and is marked as a mirror-sourced quote. Fortinet is a B2B cybersecurity vendor; there is no consumer Terms of Use to score, so consumer-style traps (auto-renew billing, price-hike emails) largely do not apply and the score is kept modest. The referenced Data Terms URL in the EULA (fortinet.com/corporate/aboutus/legal/dataterms) returned a 404 during research.
These notes come from the original draft and are not independent verification.