This is huge as most of us use a "browsewrap" license to protect our respective sites.

It would appear that all user registrations will require a "clickwrap" [en.wikipedia.org] license to be valid and webmasters should update any login and registration process ASAP.

The change they need is small though, just add a checkbox on signup pages to indicate agreeance to the terms of service. Not a huge change to the user experience.

just add a checkbox on signup pages to indicate agreeance to the terms of service. Not a huge change to the user experience.

However, it also means the links to LEGAL or TOS on bottom of every page on a site don't mean squat and are probably unenforceable unless this is overturned.

Can you imagine possibly having to agree to the TOS just to USE a site?

Worse yet, the TOS or the most important parts of the TOS could be physically embedded on the bottom of every page displayed.

That's a potentially huge change in the user experience and IMO it could happen.

That would be a huge hassle, probably a bigger waster of time than captchas.

Wow, what a big surprise. For a binding contract the contracting parties must be aware of the contract and it's conditions otherwise there is no contract. Who would have thought this.

What surprise comes next? Maybe that laws, especially privacy and consumer protection laws cannot be waived by terms of service? Or that there are different countries with different laws, and clauses that are commonly used in the US are often null and void in other countries especially EU countries because of other laws?

However, it also means the links to LEGAL or TOS on bottom of every page on a site don't mean squat and are probably unenforceable unless this is overturned.

Don't count on this to be overturned. This is basic contract law and nothing new. It's like Software TOS that have repeatedly ruled to be invalid because they were either only accessible after purchase or there was no requirement to view the license during download or even installation.

And actually it is of not much consequence either because usually you only need TOS once a user starts to interact with a website - for example signs up to a forum or a newsletter. And it's no big deal to add a box with the TOS during the signup process.

Zappos could have easily avoided this, by including the TOS in the signup process. However even then I doubt that this arbitraton clause would be valid. In many jurisdictions clauses in TOS that are deemed to be unusual or surprising are not enforcable. Waiving your right to go to court might be seen as such a clause in some states and countries.

Would this work?

*warning, if you have a lawyer or plan on hiring a lawyer within the next 12 months please go away and have a nice day*

Ok, maybe not, but honestly the damage done to the consumers was a result of the hackers illegal actions, not Zappos, ya know? Sure the user data was compromised which might cause problems for the end user but a crime had to be committed to get to that point. The system seems to miss that critical part of the equation somehow.

- Are website owners going to need web insurance just to run a forum?
- Should there be a financial limit placed on how much webmasters can be held liable for? My bank only insures the first 40,000 in my bank account so if I deposit 100,000 and a thief wipes them out I still have 40,000...

Somethings gotta give on this, it will be interesting to see which way it gives.

And actually it is of not much consequence either because usually you only need TOS once a user starts to interact with a website - for example signs up to a forum or a newsletter. And it's no big deal to add a box with the TOS during the signup process.

Define interacting with a website.

If you have a 3rd party banner ad running on your site that's been infected, which happens, and it attempts to inject malware into someone's browser, you could be sued.

I've been threatened a couple of times because a couple of sites my site links to got hacked. Not like I hacked them, but people are litigation crazy and apparently even a link to another site could get you sued. Whether someone would win such a suit or not is another issue.

My point is that interaction with a site has more implications that registration and data privacy because the first page viewed could pose a legal threat due to all sorts of bizarre circumstances which now your TOS can't control and even the jurisdictional venue and arbitration clauses are out the window.

Can you imagine possibly having to agree to the TOS just to USE a site?

"Using a site" by browsing/reading the content is one thing -- if no exchange of anything of value is taking place, there is no need for a "contract"... but if someone is making a purchase, I can definitely see forcing them to check off a box saying "[X] I've read, understand and agree to the TOS" as part of the check-out process.

If you have a 3rd party banner ad running on your site that's been infected, which happens, and it attempts to inject malware into someone's browser, you could be sued.

Except of course that if it is "injecting something" ..then it is highly likely that it is not "on your site"..but is in reality on a separate server, and your site or page is merely pointing to it..( or it may be in an iframe ) either way, the visitor's browser is where "it is"..not your fault at all if a site that you link to ( and that is what a "source" pointer that refers to a file not hosted on your site is doing )..is hosting malicious files or gets hacked..

A banner for someone else's business and hosted with your knowledge and permission on your site is a different matter..then the onus is upon you to make sure that it has nothing malicious within it..

I've been threatened a couple of times because a couple of sites my site links to got hacked.

One advantage of the much maligned links page is that you can head it up with a warning that the linked sites are somebody elses responsibility. I have seen government sites go further and require you to confirm that you understand that the linked site is not a government one before taking you there.

My point is that interaction with a site has more implications that registration and data privacy because the first page viewed could pose a legal threat due to all sorts of bizarre circumstances which now your TOS can't control and even the jurisdictional venue and arbitration clauses are out the window.

If you thought until now that if your website got hacked and caused harm you could simply point to your TOS and deny any liability or demand arbitration instead of a lawsuit you have been on the wrong track all along.

This would be like hanging TOS in your car window that state that everyone you hit with your car agrees to not hold you liable for any damages or at least waives his right to go to court.

It is more than obvious that this is utter nonsense.

@jecasc, you said exactly what I wanted to say. Normal requirements of contract law.

@incrediBill, if simply browsing a site meant you agreed to its TOS, there are two problems:

1) You would be agreeing to the TOS before seeing them. You do not even know there is a TOS until you get to the site.
2) You would have to read the TOS of every site you visited to know what you agreed had agreed to.

The only solution is to have a click to agree button that people have to click before seeing any page of a site: rather like those annoying EU cookie warnings, but worse.

None of this should be any surprise:

[ontechnologylaw.com ]

If browserwrap TOS are ever held to be binding, I am adding one, nice and lengthy, with a deeply buried clause reading: "by using this site you agree to pay a usage fee of £10,000 on demand".

I can definitely see forcing them to check off a box saying "[X] I've read, understand and agree to the TOS" as part of the check-out process.

Our ecommerce site has been doing this for a very long time.
People don't read. They dont read 90% of the time the product descriptions of what they are buying.

Maybe we should put a clause in there that says, by purchasing from this website you agree to leave only positive feedback or none at all. Leaving bad feedback will result in financial penalty.

I can definitely see forcing them to check off a box saying "[X] I've read, understand and agree to the TOS" as part of the check-out process.

A national pizza delivery chain makes you check that box every time you order. They keep making it increasingly difficult to order from them online. I'd hate to see all e-commerce sites doing that.