1

Let's say that there's a form on my website that lets the user create a new account. Then let's say that the form has a checkbox labelled "I agree to the Terms of Service" and it is otherwise clear that, by selecting the checkbox, the user is agreeing to the Terms of Service. We can also assume that the Terms of Service document is linked somewhere on this theoretical signup page. The page also requires the user to check the box before signing up.

What if the user then decides to open the developer tools, remove the "I agree" checkbox, then sign up for an account? There is, of course, nothing stopping them from doing this, because they are modifying a copy of the page data present in their browser's memory. Since the checkbox is removed from the page, it is no longer a required field, and the browser will submit the form and create the user's account as normal. Can they then claim that they have signed up for an account but did not technically agree to any terms after doing this?

2
  • 5
    Technical, not legal perspective: "the browser will submit the form and create the user's account as normal" is totally inaccurate. The browser does not create the user an account. Your server does. Your server should validate the input, because it's sent by an untrusted browser under user control, and reject the form if it doesn't have a value associated with the checkbox. If the user causes their browser to send the value indicating agreement, without actually checking a box, their argument is much weaker.
    – Ben Voigt
    Commented Dec 6, 2023 at 19:03
  • 6
    Does this answer your question? What happens if I alter the text on a web page before clicking "agree"? Commented Dec 6, 2023 at 19:06

1 Answer 1

5

This isn't going to happen

Unless the developer is a total idiot (which is always a possibility), the system will not rely on browser-side validation; there will also be server-side validation.

Yes, a user could modify the browser HTML to remove the check box, and when they click submit, a HTTP POST will be sent that is missing this data. Or, they could construct the POST directly and save the effort of fiddling with the page.

When this request arrives at the server, it will be verified, and the missing checkbox data will result in an error. So, they won't get signed up; they will get a 400-series error page.

If they modify the request to include the checkbox data, well, they've accepted; just not in the conventional way.

To not beg the question ...

Assuming that this actually worked, the user has made a counter offer which has not been accepted by the company - no contract has been formed.

If the user then proceeded to access parts of the website they would only be authorised to access if there was a contract then they can be sued for theft of services and they have committed a crime in most jurisdictions of accessing a computer exceeding authorisation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .