How to Prove, Legally, That a User Actually Clicked the &quot;I Accept&quot; for TOS, etc In a click-wrap scenario, how does one prove, legally, that a user actually clicked or checked the "i accept" or equivalent on a given site. e.g. what if the website owner doesn't track clicks, track TOS versions, etc. What if the whole user flow changed since the alleged acceptance of TOS, etc. What do the courts look for to determine whether the user did in fact take the action which confirms their agreement with the TOS, and what those TOS actually were at the time of the issue in question? ...and, with which party does the burden of proof rest and what constitutes proof?
The website owner brings in an expert programmer who testifies that the user cannot have gotten to a certain part of the site (or download, etc.) without having clicked to accept the terms of service, and that this document they're holding is a true and correct copy of the terms of service as of that date. That's evidence in favor of the site, and an adverse party has to have stronger evidence in order to overcome it. If the person didn't save a copy of the terms themselves, they'll have a hard time on this. Then the other party's attorney tries to discredit the programmer by asking questions like "how do you know there are no bugs in the software which could have allowed somebody to reach this without agreeing to the terms of service" etc. Apparently, some sites don't require users to click indicating agreement. If the company has significantly changed the site, terms of service, etc. since the time the user registered, and doesn't keep any copies of old versions around, and admits this, they'll have a hard time enforcing an agreement (as they can't produce a copy of it). If the user kept a copy, the user might be able to present that. It's up to the finder of fact to decide what to believe and how much weight to give the various witnesses' testimony.
The answer depends in part what venue you're talking about, e.g. Reddit, Facebook etc. The details are revealed somewhere in the Terms of Service for that venue. The general pattern is that you are allowed to use that venue, provides you grant permission for the service to do what they do with your content. You cannot legally send them a take-down notice for your stuff, because a take-down notice requires you to say that the stuff was posted without your permission (and that is false – and you can be punished for making that statement). There could be a venue where they do not hold you to an irrevocable license, in which case you could revoke that permission (but not Reddit: you granted them a "royalty-free, perpetual, irrevocable, non-exclusive, unrestricted, worldwide license to reproduce, prepare derivative works, distribute copies, perform, or publicly display your user content in any medium and for any purpose, including commercial purposes, and to authorize others to do so"). I've seen a site that actually asserts ownership of user-contributed content (I don't know if their TOS ended up being litigated) – if is not at all hard to write a TOS that includes transfer of copyright, rather than granting of a license. The only hard parts are (1) figuring out what you want in terms of permission to use and (2) whether your answer to (1) means nobody will use your service. SE and Reddit TOS probably are as close as you need to get for what you describe.
All oif those except perhaps the feedback seem to be &quot;transactional&quot; content to which the CAN SPAM requirements do not apply. The feedback request looks to me as if it first the 'other&quot; class in the linked FAQ, and so also would not trigger the requirements.
Yes, it's illegal. 18 USC 1030 (a) (5) (A) [Whoever] knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer [shall be punished as provided in subsection (c) of this section]. &quot;Damage&quot; is defined at (e)(8) to mean &quot;any impairment to the integrity or availability of data, a program, a system, or information&quot;. Your proposed attack would certainly cause impairment to the availability of the Stack Exchange system and the data and information which it hosts. Whatever else you may think about the Stack Exchange terms of service, they certainly do not authorize any user or moderator to &quot;destroy the site&quot; in any sense such as you describe. It's not necessary for the TOS to explicitly say &quot;you may not do X&quot;; it's enough that they don't say that you may do it. To use a firewall analogy, it's &quot;default deny&quot;. &quot;Protected computer&quot; is defined in (e)(2) to mean, essentially, any computer that is used in or affects interstate commerce. Which means practically every computer that has ever accessed the Internet, and certainly includes Stack Exchange servers. So your proposed attack would include all the elements of a violation of this section. Such a violation is punishable by up to five years' imprisonment if it causes a loss of more than $5000 (see (4)(A)(i)(I)), which if such an attack were successful, it certainly would. Greater penalties are possible in certain circumstances. Even if the loss does not exceed $5000, or if the attack is merely attempted but without success, it is still punishable by one year imprisonment or a fine ((4)(G)(i)). There is nothing in the terms of service saying you will go to federal jail for destroying stack exchange. Irrelevant. It is not up to Stack Exchange Inc. or its TOS to determine who does or doesn't go to federal prison. Rather, it is up to Congress to determine what conduct deserves such punishment (as they did in 1984 by enacting this law), up to federal law enforcement and prosecutors to investigate and make a case against an alleged violator, and up to the federal courts to determine if the accused is guilty and how they should be punished.
The notification that you saw is not useful legal information for you: stuff always belongs to whoever owns the stuff. It might be interpreted as saying "it doesn't belong to us", but you can't count on that (it's virtually guaranteed that at least some of the content there is owned by the website owner). A more informative statement would be "You will have to get permission from the content owner to copy their stuff", and "We're not going to spend time figuring out who owns what". You could read the terms of service (try this with Stack Exchange) to see what the site tells people. The TOS here says that if you contribute anything, it "is perpetually and irrevocably licensed to Stack Exchange under the Creative Commons Attribution Share Alike license". You can then look up what that license says and learn what that allows. Websites are kind of tricky, though, because it's not hard to change the wording of a TOS, and you need to know what specific TOS was promulgated at the time a particular contribution was unleashed. Usual practice is to think it through carefully and not frequently tweak the TOS, but it's not illegal to change the TOS. Note that copyright law does not prohibit you from using other people's stuff, it prohibits you from copying. The distinction is clearer when you see a post that explains an algorithm with actual code, you read and learn and make use of that, but write your own code. As a user out there, if there isn't a clear indication that stuff posted is there for the taking, under some public license (as is the case with SE), then getting specific permission to copy, from the owner of the content (possibly untraceable), would be necessary. Now assume that you're a moderator or site-owner of some forum: presumably (hopefully) you have a TOS that addresses that situation, which says that moderators have the right to edit or delete content at their sole discretion, and also you say what kinds of posts are prohibited. Such an statement is not absolutely mandatory for all things, but it may be necessary to avoid litigation over some acts. One one end of the spectrum, it would be illegal for a forum to host child porn, stolen credit card numbers, or protected digital content. If a user were to post such stuff, the site would need to eliminate that stuff, and the poster could not legally rely on an argument of the type "That's my stuff, you have no right to mess with it". On the other hand, if a forum actually requires paid membership, then there may be a strong contractual expectation that the user is getting something of value, so you would have to watch for statements that could be interpreted as broad permission to put stuff out there without any interference. (For instance, a file-hosting service would have only minimal restrictions on content, aimed at protecting their own legal interests; whereas a political-advocacy site would have maximal interest in prohibiting the expression of views counter to the cause). Thus the SE TOS has you "grant Stack Exchange the perpetual and irrevocable right and license to use, copy, cache, publish, display, distribute, modify, create derivative works", which allows moderators to correct typos, delete offensive wording, and obliterate entire posts. If a site fails to have any such clauses in their TOS, then it might be a matter that has to be settled in court, whether they have the right to eliminate "spam" (i.e. advertising for a service, especially if the reason for getting an account was to provide an advertising platform). In light of the limited use sanctioned by the TOS, per the below comment, legal copying will be quite limited. However, "fair use" a situation where copying is allowed, regardless of what the TOS may say. (You could be banned from the site, but you could not be sued for infringement). Fair use was invented precisely so that people could make comments like "Jones advocates an absurd law, saying '...[quote from Jones]...'". Thus you can comment on a post and quote the relevant part ("The lines '[... quoting the code ...]' results in an infinite loop"). See the Fair Use FAQ for more details.
Most user complaints against Meta are subject to binding arbitration under the applicable terms of service (which is the principal contract between a user and Meta) and cannot be litigated in the court system. The example of a dispute in the question would not generally fall within the exceptions to the arbitration clause. It states, in part: The Instagram Service is one of the Meta Products, provided to you by Meta Platforms, Inc. These Terms of Use therefore constitute an agreement between you and Meta Platforms, Inc. ARBITRATION NOTICE: YOU AGREE THAT DISPUTES BETWEEN YOU AND US WILL BE RESOLVED BY BINDING, INDIVIDUAL ARBITRATION AND YOU WAIVE YOUR RIGHT TO PARTICIPATE IN A CLASS ACTION LAWSUIT OR CLASS-WIDE ARBITRATION. WE EXPLAIN SOME EXCEPTIONS AND HOW YOU CAN OPT OUT OF ARBITRATION BELOW. . . . How We Will Handle Disputes. Except as provided below, you and we agree that any cause of action, legal claim, or dispute between you and us arising out of or related to these Terms or Instagram (&quot;claim(s)&quot;) must be resolved by arbitration on an individual basis. Class actions and class arbitrations are not permitted; you and we may bring a claim only on your own behalf and cannot seek relief that would affect other Instagram users. If there is a final judicial determination that any particular claim (or a request for particular relief) cannot be arbitrated in accordance with this provision's limitations, then only that claim (or only that request for relief) may be brought in court. All other claims (or requests for relief) remain subject to this provision. Instead of using arbitration, you or we can bring claims in your local &quot;small claims&quot; court, if the rules of that court will allow it. If you don't bring your claims in small claims court (or if you or we appeal a small claims court judgment to a court of general jurisdiction), then the claims must be resolved by binding, individual arbitration. The American Arbitration Association will administer all arbitrations under its Consumer Arbitration Rules. You and we expressly waive a trial by jury. The following claims don't have to be arbitrated and may be brought in court: disputes related to intellectual property (like copyrights and trademarks), violations of our Platform Policy, or efforts to interfere with the Service or engage with the Service in unauthorized ways (for example, automated ways). In addition, issues relating to the scope and enforceability of the arbitration provision are for a court to decide. This arbitration provision is governed by the Federal Arbitration Act. You can opt out of this provision within 30 days of the date that you agreed to these Terms. To opt out, you must send your name, residence address, username, email address or phone number you use for your Instagram account, and a clear statement that you want to opt out of this arbitration agreement, and you must send them here: Meta Platforms, Inc. ATTN: Instagram Arbitration Opt-out, 1601 Willow Rd., Menlo Park, CA 94025. Before you commence arbitration of a claim, you must provide us with a written Notice of Dispute that includes your name, residence address, username, email address or phone number you use for your Instagram account, a detailed description of the dispute, and the relief you seek. Any Notice of Dispute you send to us should be mailed to Meta Platforms, Inc., ATTN: Instagram Arbitration Filing, 1601 Willow Rd. Menlo Park, CA 94025. Before we commence arbitration, we will send you a Notice of Dispute to the email address you use with your Instagram account, or other appropriate means. If we are unable to resolve a dispute within thirty (30) days after the Notice of Dispute is received, you or we may commence arbitration. We will pay all arbitration filing fees, administration and hearing costs, and arbitrator fees for any arbitration we bring or if your claims seek less than $75,000 and you timely provided us with a Notice of Dispute. For all other claims, the costs and fees of arbitration shall be allocated in accordance with the arbitration provider's rules, including rules regarding frivolous or improper claims. For any claim that is not arbitrated or resolved in small claims court, you agree that it will be resolved exclusively in the U.S. District Court for the Northern District of California or a state court located in San Mateo County. You also agree to submit to the personal jurisdiction of either of these courts for the purpose of litigating any such claim. The laws of the State of California, to the extent not preempted by or inconsistent with federal law, will govern these Terms and any claim, without regard to conflict of law provisions. While I haven't checked every single Meta service, I would strongly suspect that the Terms of Service for all of their online offerings have very similar provisions to this one.
Congrats, you've done well to minimize your processing of personal data. But I think you're still processing personal data, and are subject to the GDPR. Serving a website necessarily involves processing an IP address. This IP address will typically be personal data. While you are not storing the IP address, the GDPR's definition of “processing” extends beyond storage and pretty much covers doing anything with that IP address. As far as I know this is not an entirely settled matter, but it's better to err on the side of caution and to assume that you are in fact performing a processing activity. Even a static web page can easily lead to additional relevant processing of personal data, for example if the HTML embeds resources from third party domains. Since your website is clearly targeted at the public, it does not fall under the GDPR's exception for “purely personal or household” purposes. So I think you do need a (minimal) privacy notice that contains at least the items mentioned in Art 13 GDPR. The main reason why some people try to avoid posting a privacy notice is because it must disclose your identity and contact details. But in Germany, that information has to be provided anyway due to the Impressumspflicht. As part of your GDPR compliance obligations, you must protect how data is processed by others on your behalf. A hosting provider will typically act as your data processor. For this to be legal, you need a contract / data processing agreement that fulfills the conditions in Art 28 GDPR. This contract binds the data processor to only use the data as instructed by you, and not for their own purposes. European hosting providers sometimes include the necessary terms in their terms of service / AGB, but you should check to make sure. Netcup expects you to accept their data processing amendment in your account settings. In the hypothetical case that you were not processing any personal data at all, the GDPR would not apply and it wouldn't require you to post a privacy notice. Other laws might still have information obligations, notably the German TMG and TTDSG.
You tag the question with "criminal law", suggesting that by "illegal" you mean "is it a crime" -- that would depend on jurisdiction, but in the US or my state, it is not a crime. There are crimes that you could commit with such an account, but violating the TOS is not itself a crime. However, it is illegal, a breach of contract, as you can see from the TOS "You will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission".