I know I need to have a mandatory EULA accepted before allowing users onto my system.

Simply recording information about the user and having a database column with "accepted" doesn't seem like it would act as proof someone actually accepted the terms before use.

Someone could just claim my system never presented them with any EULA, and they never agreed to such terms. Seems this would be a "your word against mine" sort of thing.

How do I go about proving a user accepted my terms before using the system?

  • 1
    How inconvenient are you willing and able to make it for the end user? If convenience isn't a big concern you could just deny access until they give you a call, at which point you inform them you're recording and recite the EULA to them. Get them to identify themselves, accept, state the date and time, then you give them a temporary password good for 15 minutes after the stated time. Then they log in, change password, boom. There are other less inconvenient ways to "phone home" and accomplish similar things - Google "non-repudiation".
    – Patrick87
    Feb 18, 2016 at 20:38

2 Answers 2


IANAL, but from my understanding, a EULA is a Contract of Adhesion https://www.law.cornell.edu/wex/adhesion_contract_contract_of_adhesion

And the clickwrap EULAs and TOSs you click through everywhere are reasonably safe for you to use: https://ilt.eff.org/index.php/Contracts:_Click_Wrap_Licenses

But, if you are recording user "click through" information in your own database, there are a few more aspects to your EULA that concern possible protections and liabilities to you.

By gathering personal information, you can be more certain the EULA has been clicked (or even read, god-forbid) by someone a bit more real than your average software clicker-and-user. The amount of info you gather depends on your needs, and could also include an email response from that user to confirm details and the EULA. That would seem to add more protection to you from the EULA.

And, when you say "your system," it sounds like they are logging in and accepting the EULA on a server you control. If so, you will have IP access logs for users, in addition to their EULA.

But, gathering that information could be a liability. A web user who clicks on a EULA sets a cookie in their browser or in a preference file on their hard-drive. You are gathering personal information and storing it yourself or at a third party, and you need to store it securely if it is anything more than name, email and phone. And ditto your own server; if the records are on the same server as the software and the user logins, you should be sure they are separate and secure.

And, of course, it is illegal to store many types of financial information without complying with strict state and federal laws. But if you are selling the software, you could also have the EULA integrated into a sales receipt and/or have a condition of them checking off they have accepted the EULA before they get a receipt.

Some/all of those options would make it hard for a customer to prove they didn't know what they were getting and dissuade them from complaining when faced with different types of proof showing they knew about the EULA.


A vendor usually has no need at all to prove that you accepted a EULA.

When you buy software, you have some very limited rights to use the software given to you by copyright law. These rights are very limited; basically you don't have the right to do anything that involves copying the software.

The EULA typically gives you more rights than the copyright law would. Not as many rights as you would like, maybe, but more than you have without the EULA. Therefore, if you claim that you didn't accept the EULA you will just lose the rights given to you by the EULA and be worse off.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .