Internet “Terms of Service” (TOS) 1E.g., https://www.facebook.com/legal/terms (“By using or accessing Facebook, you agree to this Statement, as updated from time to time in accordance with Section 14 below.”); https://twitter.com/tos (“Your access to and use of the Services are conditioned on your acceptance of and compliance with these Terms. By accessing or using the Services you agree to be bound by these Terms.”). are ubiquitously found on most websites. The TOS may be one document or several, and usually include a privacy policy. Do TOS constitute genuine “contracts” that are enforceable against users? Conversely, may users enforce TOS against the owner of the social media site? It depends on the presentation and the issue.
May TOS Be Enforced Against a User?
The fundamentals of contract law remain intact in the Internet age. As one court has put it, “While new commerce on the Internet has exposed courts to many new situations, it has not fundamentally changed the principles of contract.” 2Register.com, Inc. v. Verio, Inc., 356 F.3d 393, 403 (2d Cir. 2004) (Register) (9 ECLR 81, 1/28/04). One of those fundamental principles is that the party against whom an agreement is to be enforced must have agreed, in some fashion, to the contract terms. In other words, contracts cannot be imposed unilaterally. As phrased by the Second Circuit in Specht v. Netscape Commc’n Corp.
3Specht v. Netscape Commc’ns Corp., 306 F.3d 17, 29 (2d Cir. 2002) (Specht) (7 ECLR 999, 10/9/02)., contract law requires a “mutual manifestation of assent, whether by written or spoken word or by conduct …”
How does one manifest consent in the Internet age?
Clickwrap License Agreements. Through its website, the site owner could require a user to affirmatively consent before full access is granted. The owner could do this by requiring the user to click on something, such as an “I agree” box. 4E.g., Register, and discussion at footnote 41 therein. This method is frequently referred to as a “clickwrap” or “click-through” license agreement. For example, a box could pop up on the user’s screen containing the full text of the site owner’s agreement. The user would be required to answer inquiries in a manner indicating the user’s agreement in order to continue. Alternatively, in the case of a software download, the user would be required to “click” his or her consent to the downloaded agreement before the software will perform. 5Uniform Commercial Code Article 2 would be applicable to a purchase/license of software to the extent that the software is characterized as a “good,” rather than a “service.” This much litigated distinction will not be considered here, because social media sites provide services to users, hence the name Terms of Service.
Because clickwrap agreements give the user notice of the agreement and require a manifestation of consent, such agreements have been enforced by courts, even if the user claims not to have read them. 6See, e.g., Feldman v. Google, Inc., 513 F.Supp.2d 229 (E.D. Pa. 2007) (12 ECLR 311, 4/4/07). For example, Facebook’s “click accepted” TOS with a forum selection clause was upheld by the U.S. District Court for the Southern District of New York in Fteja v. Facebook. 7Fteja v. Facebook , 841 F. Supp. 2d 829 (S.D.N.Y. Jan. 24, 2012). Of course, a particular term might be ruled unenforceable on other grounds. In Bragg v. Linden Research Inc., a dispute about ownership of virtual land in a Second Life account, the court refused enforcement. In the equivalent of an unconscionability finding, the court stated that Second Life is a business that operates across multiple states and therefore it may be sued outside of California. Its TOS may not limit a user’s rights. 8Jacqui Cheng, Second Life “Land” Dispute Moves Offline to Federal Courtroom, Ars Technica, June 4, 2007, available at http://arstechnica.com/tech-policy/2007/06/second-life-land-dispute-moves-offline-to-federal-courtroom.
Browsewrap Agreements. Obtaining consent through a clickwrap agreement can be cumbersome, perhaps even impractical. Insertion of a consent mechanism might require site redesign, such as an entry portal. More commonly, an owner causes a pop-up window to display the proposed agreement and bar further interaction until affirmative responses have been checked. The problem, however, is if the site does not sell a product or service and does not require account registration, there may be no access point at which to require a user to examine the TOS. If a site launched a clickwrap pop-up as part of its entry page, casual users would likely be put off or, if possible, circumvent the pop-up.
Thus, many Internet TOS provide that site usage constitutes consent to the TOS. 9See examples cited in Footnote 1. Courts have called this a “browsewrap” license agreement, mainly for historical reasons. Software licenses evolved along with technology. Thus, a physical document signed by each contracting party in time gave way to licenses that accompanied physical disks containing the software. Because of the shrinkwrap packaging, and with the user’s tearing of it becoming the defining point of contract formation, such form was dubbed a “shrinkwrap” agreement. 10A historical discussion can be found at Register, 356 F.3d at 428. The “wrap” syllable stuck to subsequent license forms to become “clickwrap” and “browsewrap,” in a manner similar to the way that the original Watergate plot led to subsequent “gate” episodes denoting suspect activity.
Alerting the user to the existence of a browsewrap agreement is the tricky part. The owner might insert a hyperlink at the top or bottom of the site’s home page, or even on each page. At a page enabling a purchase or account setup, the owner might direct users how to access the TOS. The design of some sites might require the user to click multiple layers to reach the TOS, while others are more direct. And some are repetitive, such as by stating on the account setup page that, by opening the account, he/she is agreeing to the TOS. Are these passive measures sufficient to establish a binding agreement? Stated as posited by the Second Circuit in Specht, would a “reasonably prudent offeree” know of the existence of the license terms? 11Specht, 306 F.3d at 31. Typically, and in contrast to a clickwrap, the site creates no record whether the user clicked the hyperlink, opened the TOS and read them.
When a social media site seeks to enforce the TOS against a user (or multiple users, in the case of a class action), enforceability depends on user interaction. In Schnabel v. Trilegiant Corp., 12697 F.3d 110 (2d Cir. 2012) (Schnabel) (17 ECLR 1597, 9/12/12). the Second Circuit considered whether to enforce a TOS binding arbitration provision. The court stated that, “[T]he touchstone of the inquiry … is the parties’ outward manifestations of assent.” 13Id. at 119. Relying upon the Restatement (Second) of Contracts § 19(2), the court continued, “[T]he conduct manifesting such assent may be words or silence, action or inaction, but ‘[t]he conduct of a party is not effective as a manifestation of his assent unless he intends to engage in the conduct and knows or has reason to know that the other party may infer from his conduct that he assents.”
In Schnabel, the plaintiffs contested that they had agreed to a subscription service called Great Fun. The subscription agreement and fee schedule were accessible through hyperlinked pages that were accessible after plaintiffs had made a purchase from Priceline.com. The plaintiffs denied that they actually clicked through the hyperlinks to discover the agreement, which contained the binding arbitration provision at issue. After analysis, the court ruled that the plaintiffs were not put on inquiry notice of the arbitration clause. Additionally, the site owner argued that even if the browsewrap agreement failed to create a binding agreement, one was created when the challenged fees were subsequently debited from the plaintiffs’ credit cards. The court rejected this argument, as well, finding that auto-debits were too passive of an activity to create a binding agreement. 14Id.
Thus, the determinative factor in Schnabel was the site owner’s failure to provide proof that a user had read and agreed to its TOS. A similar result was reached by a New York district court in Hines v. Overstock.com. 15Hines v. Overstock.com, 668 F.Supp.2d 362 (E.D.N.Y. 2009) (14 ECLR 1287, 9/16/09). In Overstock, the court refused to enforce a TOS arbitration clause of Internet retailer Overstock because there was no evidence that consumers had knowledge of or had read the policy. Overstock is particularly instructive, because the retailer did what most do—its Web page had stated, “Entering the Site will constitute your acceptance of these Terms and Conditions.”
Will a more specific notification increase the likelihood of enforceability? Some site owners alert users to the TOS on a purchase or account creation page. They might even use large type or different color font. But even then, enforcement remains uncertain in light of the Ninth Circuit’s recent opinion in Nguyen v. Barnes & Noble Inc.
16763 F.3d 1171 (9th Cir. 2014) (Nguyen). In analyzing the Barnes & Noble site, the court found no evidence that plaintiff had received actual notice of the TOS or that the user was affirmatively required to acknowledge the TOS before completing an online purchase. The court observed, “Courts have been more willing to find the requisite notice for constructive assent where the browsewrap agreement resembles a clickwrap agreement—that is, where the user is required to affirmatively acknowledge the agreement before proceeding with the use of the website.” 17Id. Although the language casts doubt whether any browsewrap agreement could be enforceable, the court nevertheless stated that such agreements are not per se unenforceable, and it noted that one was enforced in Zaltz v. JDATE. 18952 F.Supp.2d 439 (E.D.N.Y. 2013) (18 ECLR 2270, 7/31/13). In Zaltz, before opening an account, members checked a box to confirm that they both read and agreed to the TOS.
So What Is Required?
Website presentation is crucial. The Nguyen court considered whether the website design would put a “reasonably prudent user” on inquiry notice of the existence of the TOS. After surveying recent opinions, the Ninth Circuit concluded, “In short, the conspicuousness and placement of the ‘Terms of Use’ hyperlink, other notices given to users of the terms of use, and the website’s general design all contribute to whether a reasonably prudent user would have inquiry notice of a browsewrap agreement.” On the other hand, where the TOS link is buried at the bottom or buried in obscure corners or under multiple layers where users are unlikely to see the TOS easily, courts have refused to enforce them. In Specht, the inadequate hyperlink was at page bottom, hidden below the “download” button that users had to click to initiate the software download.
Are browsewrap agreements ever ironclad? After Nguyen, it seems the answer is no. Consider these facts: Barnes & Noble’s hyperlink was in the bottom left-hand corner of every page, and an additional notice was placed in close proximity to the buttons a user must click to complete an online purchase. Furthermore, its hyperlinks on the checkout screens were presented in underlined, color-contrasting text. Would a “reasonably prudent offeree” understand? No, according to the Ninth Circuit. These measure were insufficient because the purchase screen did not prompt the user to review the TOS.
The learning from Nguyen might be that arbitration provisions will be given greater scrutiny. Looking at this provision in isolation, would a user who enters a news site to glance at headlines have an inkling that he or she had agreed, by reading an embedded article, to arbitration in New York? 19See supra note 1. Harking back to Specht’s “reasonably prudent” user test, a prudent user might not expect to be ensnared by arbitration. Disfavor with arbitration provisions might not mean that the entire TOS is unenforceable. However, if a site owner believes that enforcement of a forum selection or arbitration clause is of utmost importance, then it is advisable to use a clickwrap agreement.
The result might be different if the TOS provision is one that the user might be expected to know, such as a rule of law. For example, users would be expected to know that they cannot post another’s copyrighted work, absent a legitimate claim of fair use. Such infringement would be the product of a purposeful action on the user’s part, and ignorance is not a defense to a violation of law. Therefore, a court might well enforce a TOS prohibition against posting infringing material and support a site owner that removes a user’s post in response to receipt of a takedown notice pursuant to the Digital Millennium Copyright Act (DMCA). 2017 U.S.C. § 512 Most DMCA cases have been brought against the social media site owner (also known, in this respect, as an “intermediary”), 21E.g., Perfect 10, Inc. v. Amazon.com, Inc., 508 F.3d 1146 (9th Cir. 2007). although intermediaries have a degree of immunity. 2217 U.S.C. §512; Communications Decency Act, 47 U.S.C. § 230. This analysis is pertinent, however, because there are frequent calls to repeal or reduce the immunity of social media sites. Thus, in drafting the TOS, as in all things, clarity is helpful. The TOS should be clear that a user may not upload, post, copy or distribute infringing content; that the site owner disclaims liability for infringing or misappropriated content; and that it reserves the right to remove such content, whether upon receipt of a DMCA notice or upon its own determination of infringement.
Even when venturing beyond the disfavored arbitration forum selection clauses, the TOS should not contain surprising terms, to enhance enforceability. TOS, at times, claim overly broad rights. A site owner might grant itself a broad license in posted material, backed by unlimited indemnification rights if the material turns out to violate copyright laws. 23E.g., see TOS hyperlinked in footnote 1. This author is unaware of an attempt by a site to enforce a broad license or an indemnification. It is dubious that a “reasonably prudent” user would anticipate the breadth of these provisions, much the way users did not anticipate Facebook’s psychological experiments on users. In defending its actions, Facebook pointed to a provision in its then-existing TOS in which each user granted grant to his/her information being used for “internal operations, including troubleshooting, data analysis, testing, research and service improvement.” 24Zach Schonfeld, Facebook Performed a Psychology Experiment on Thousands of Users Without Telling Them, Newsweek, July 1, 2014, available at http://www.newsweek.com/facebook-performed-psychology-experiment-thousands-users-without-telling-them-256914. Despite its initial stand on license rights, Facebook has since recanted.
Another sometimes problematic provision in TOS is one that states that the account is not assignable, 25E.g., Twitter TOS § 6. or that it is transferable only with the owner’s consent. 26E.g., Facebook TOS § 19(6). If a small business owner has created significant wealth by marketing its business through the “free” social media outlets, it might confront difficulty selling its assets if its advertising channels and followers cannot be transferred with assurance. 27For more discussion, see Regina M. Joseph, Social Media and Digital Assets in M&A Transactions, Shumaker Insights Newsletter, May 1, 2014, available at http://www.slk-law.com/NewsEvents/Publications/68218/Social-Media-and-Digital-Assets-in-MA-Transactions. If the social media site owner determines that an account has been assigned in violation of the TOS, the TOS give it the right to suspend or even terminate the account. Or it might ignore a request to change the account name, as would be the case if the account were in the personal name of the selling business owner. Anecdotally, it seems that site owners are more accommodating than their TOS would lead one to believe. Or, their search engines do not yet give them the full ability to detect transfers as opposed to, for example, rebranding. However, uncertainties relating to transferability must be factored into preparations for closing the sale transaction. Similarly for natural persons, account preservation and transfer upon death will no doubt become a greater issue in the future. Delaware has been the first state to enact laws overriding transfer prohibitions in TOS. 28Delaware H.B. 345, signed Aug. 12, available at http://legis.delaware.gov/LIS/LIS147.nsf/vwLegislation/HB+345?Opendocument.
Social media is constantly evolving, and the law is playing catch-up. Many of the above issues are unresolved at the present time and will no doubt be eventually resolved through a combination of court action and pressure brought to bear by users. After all, users have a global platform for broadcasting their complaints.
Are TOS Enforceable Against the Site Owner?
To enforce TOS against a website site owner, a user possesses in its arsenal other, perhaps more easily pursued, legal arguments than breach of contract, not to mention a potential friend with a big hammer.
The Federal Trade Commission (FTC) administers the Federal Trade Commission Act (the FTC Act), which prohibits, among other things, fraudulent, deceptive and unfair business practices. 2915 U.S.C. § 45(a). The FTC has taken action against social media sites that have failed to adhere to their “promises” made in TOS, with privacy being an important focus. 30E.g., In re Facebook Inc., No. 092-3184 (F.T.C. Aug. 10, 2012), available at http://www.ftc.gov/enforcement/cases-proceedings/092-3184/facebook-inc; In re Myspace LLC, No. 102-3058 (F.T.C. Sept. 11, 2012) (17 ECLR 1686, 9/19/12), available at http://www.ftc.gov/enforcement/cases-proceedings/102-3058/myspace-llc-matter; In re Goldenshores Technologies LLC, No. 132-3087 (F.T.C. Apr. 9, 2014), available at http://www.ftc.gov/enforcement/cases-proceedings/132-3087/goldenshores-technologies-llc-erik-m-geidl-matter; In re Jerk LLC, No. 122-3141 (F.T.C. complaint filed Apr. 7, 2014) (19 ECLR 442, 4/9/14), available at http://www.ftc.gov/enforcement/cases-proceedings/jerk-llc-dba-jerkcom-matter; In re Snapchat Inc., No. 132-3078 (F.T.C. May 8, 2014 (19 ECLR 626, 5/14/14)), available at http://www.ftc.gov/enforcement/cases-proceedings/132-3078/snapchat-inc-matter; In re Google Inc., No. 102-3136 (F.T.C. Oct. 24, 2011), available at http://www.ftc.gov/enforcement/cases-proceedings/102-3136/google-inc-matter; RockYou Inc., No. 102-3120 (F.T.C. Mar. 27, 2012 (17 ECLR 643, 4/4/12)), available at http://www.ftc.gov/enforcement/cases-proceedings/1023120/rockyou-inc. For example, in March 2011, the FTC entered into a consent order with Twitter Inc. 31In re Twitter Inc., No. 092-3093 (F.T.C. Mar. 11, 2011) (16 ECLR 630, 4/13/11), available at http://www.ftc.gov/sites/default/files/documents/cases/2011/03/110311twitterdo.pdf. for its alleged failure to adhere to its TOS privacy policy and to safeguard personal information. The FTC had alleged that serious lapses in Twitter’s data security allowed hackers to obtain unauthorized administrative control of Twitter, including both access to nonpublic user information and tweets that consumers had designated as private. The FTC’s order imposes various requirements for Twitter’s privacy that remain in effect until 2031.
Similarly, the FTC entered into an Agreement Containing Consent Order with Facebook in August 2012. 32See supra note 30. The FTC charged that Facebook had deceived consumers by telling them they could keep their information on Facebook private, and then repeatedly allowed it to be shared and made public. The settlement required Facebook to take steps to live up to its “promises,” including by giving consumers clear and prominent notice and obtaining their express consent before sharing information inconsistent with their selected privacy settings. During the 20-year duration of the FTC’s order, Facebook is required to obtain biennial privacy audits from an independent third party. Facebook also came under FTC scrutiny in April 2014 when it acquired WhatsApp. The FTC book the position that failure to continue to abide by WhatsApp’s privacy policy after consummation Facebook’s purchase might cause both companies to be in violation of FTC Act § 5, as well as the foregoing August 2012 Consent Order. 33Letter from Jessica L. Rich, Director of the FTC Bureau of Consumer Protection, to Erin Egan, Chief Privacy Officer, Facebook, and to Anne Hoge, General Counsel, WhatsApp Inc. (April 10, 2014), available at http://www.ftc.gov/system/files/documents/public_statements/297701/140410facebookwhatappltr.pdf.
Even if a “promise” about personal data is not set forth explicitly in the TOS, the FTC may take action if personal data is collected without disclosure and without authorization. 34E.g., Path, Inc., No. 122-3158 (F.T.C. Feb. 1, 2013) (18 ECLR 264, 2/6/13), available at http://www.ftc.gov/enforcement/cases-proceedings/122-3158/path-inc; RockYou, supra note 30; Frostwire LLC, No. 11-cv-23643 (S.D. Fla. Oct. 12, 2011) (16 ECLR 1727, 10/19/11), available at http://www.ftc.gov/sites/default/files/documents/cases/2011/10/111012frostwirestip.pdf; In re HTC America Inc., No. 122-3049 (F.T.C. July 2, 2013), available at http://www.ftc.gov/enforcement/cases-proceedings/122-3049/htc-america-inc-matter. Depending on the content sold, selling of personal information would also be governed by the Fair Credit Reporting Act, 3515 U.S.C. § 1681 et seq. also administered by the FTC. Enforcement of the Fair Credit Reporting Act could ensnare a company that is not a formal credit reporting agency. 36E.g., United States v. ChoicePoint Inc., No. 06-cv-0198 (N.D. Ga. Sept. 2, 2010), available at http://www.ftc.gov/enforcement/cases-proceedings/052-3069/choicepoint-inc; United States v. Spokeo Inc., No. 12-cv-05001 (C.D. Cal. June 19, 2012) (17 ECLR 1102, 6/20/12), available at http://www.ftc.gov/enforcement/cases-proceedings/1023163/spokeo-inc. Although a social media platform enjoys broad immunity for third-party content that is hosted or transmitted through its site, 37Communications Decency Act, 47 U.S.C. § 230. However, an initiative by state attorneys general could lead to a curtailment of such immunity. See, e.g., Eric Goldman, The State Attorneys General Want to Eviscerate A Key Internet Immunity, Forbes, June 26, 2013, available at http://www.forbes.com/sites/ericgoldman/2013/06/26/the-state-attorneys-general-want-to-eviscerate-a-key-internet-immunity. a site directed at children must also comply with the FTC’s Children’s Online Privacy Protection Rule, known as COPPA. 3816 CFR pt. 312.
A user wishing to take direct action for a TOS violation could initiate a breach of contract suit. However, contract claims might confront various affirmative defenses, such as lack of privity, unforeseeable consequences and failure to mitigate of damages and the amount of loss flowing from the breach might be speculative. Punitive damages are usually not granted. Therefore, a user might look to a variety of common law theories, such as promissory estoppel, misrepresentation, false advertising and consumer protection or privacy statutes. Since such theories assume many users in the same position have suffered harm, the user might want to combine with others in a class action suit. 39See, e.g., the class action suits against Facebook for breach of data privacy: Lane v. Facebook, filed in the U.S. District Court for the Northern District of California on March 17, 2010 (settled); and the unrelated European class action reported, among other places, at Techcrunch, http://techcrunch.com/2014/08/04/europe-vs-facebook-class-action. This possibility has engendered the proliferating class action waivers, mandatory arbitration provisions and forum selection clauses in TOS, which give rise to the enforceability issues presented in the initial part of this article.
As social media continues to become an important channel for people to reach friends and relatives, as well as important for business to reach other businesses and consumers, the TOS will come under increasing scrutiny. Although the sites are privately owned, private ownership has not historically stood as a bar to regulatory prescriptions of fair standards. In this, Specht provides a useful governing principle: “What does a reasonably prudent user expect in using this site?”
