An “accept terms and conditions” checkbox is legally binding when the user had a fair chance to see the terms and the click was a clear, voluntary act of agreement. Federal law treats that click as the equivalent of a handwritten signature, and nearly every state backs that up. What decides enforcement is not the checkbox itself but everything around it: where it sits, what it says, whether the terms are actually reachable, and whether the user had to do something deliberate to activate it.
The Federal Rule That Makes a Click Count
The Electronic Signatures in Global and National Commerce Act defines an electronic signature as any electronic sound, symbol, or process that a person adopts with intent to sign a record.1Office of the Law Revision Counsel. 15 USC 7006 – Definitions Clicking a checkbox fits that definition. The statute also bars courts from refusing to enforce a contract solely because it was formed electronically.2Office of the Law Revision Counsel. 15 USC Chapter 96 – Electronic Signatures in Global and National Commerce
Nearly every state has adopted the Uniform Electronic Transactions Act, which uses the same definition and gives digital contracts state-level recognition. Between the two laws, the legal footing for checkbox agreements is settled across the country. What is not settled, and what courts spend their time deciding, is whether a particular checkbox implementation gave the user real notice and captured real assent.
What Courts Actually Look At
Two questions run through almost every ruling on online agreements: did the user get reasonable notice of the terms, and did their action clearly show they were agreeing?
Reasonable Notice
The user needs a genuine opportunity to read the terms before agreeing. In Specht v. Netscape, the Second Circuit rejected a download page where the license appeared only if the user scrolled past the download button to a separate screen. The court said there is no reason to assume visitors will scroll beyond an action button to find hidden terms, and emphasized that “reasonably conspicuous notice of the existence of contract terms and unambiguous manifestation of assent to those terms by consumers are essential if electronic bargaining is to have integrity and credibility.”3Open Casebook. Specht v Netscape Communications Corp, 306 F3d 17 (2002)
Unambiguous Assent
The click has to communicate agreement, not just continuation. In Berman v. Freedom Financial Network, the Ninth Circuit held that the notice must be “unambiguously tied to some act of the website user that manifests assent,” and that the act itself must be framed as agreeing to the terms.4United States Court of Appeals for the Ninth Circuit. Berman v Freedom Financial Network LLC A button labeled only “Continue” or “Next,” with no reference to any terms, does not show the user understood they were entering a contract.
On the other side of the line, Feldman v. Google upheld an agreement where the full terms sat in a scrollable text box with a bold instruction to read carefully, and the user clicked “Yes, I agree to the above terms and conditions” to proceed. The court added that failing to actually read an enforceable clickwrap agreement does not excuse a user from its terms.5United States District Court for the Eastern District of Pennsylvania. Feldman v Google Inc
Not Every Online Agreement Is a Checkbox Agreement
Courts separate online agreements into three types, and only one of them involves an actual checkbox. The distinctions matter because searchers sometimes assume all three carry the same weight. They don’t.
A clickwrap agreement shows the terms (or an obvious link to them) and makes the user check a box or click “I agree” before continuing. This is the format with the strongest track record in court, and Feldman is the standard example.
A sign-in wrap replaces the checkbox with a notice near a sign-up or login button, typically something like “By clicking Register, you agree to our Terms of Service.” The Ninth Circuit held in Berman that these can be enforceable, but only when the notice is conspicuous, the hyperlink is readily identifiable (ideally in a contrasting color), and the text explicitly tells the user that completing the action means accepting the terms.4United States Court of Appeals for the Ninth Circuit. Berman v Freedom Financial Network LLC A small gray notice tucked under a bright “Sign Up” button usually fails.
A browsewrap is the weakest form. Terms sit behind a footer link, and merely using the site supposedly means accepting them. The Ninth Circuit rejected this approach in Nguyen v. Barnes & Noble, holding that a hyperlink at the bottom of a page, with no prompt for the user to act, did not create constructive notice even though it appeared on every page.6United States Court of Appeals for the Ninth Circuit. Nguyen v Barnes and Noble Inc The more deliberate the user’s action, the more likely a court will enforce the deal.
Designing a Checkbox That Will Hold Up
Most enforcement failures trace back to a few recurring shortcuts.
Leave the box unchecked. A pre-checked box requires no deliberate action, which guts the assent argument. The FTC has identified pre-checked boxes as a deceptive design tactic regulators actively scrutinize.7Federal Trade Commission. FTC Report Shows Rise in Sophisticated Dark Patterns Designed to Trick and Trap Consumers Under the EU’s General Data Protection Regulation, pre-ticked boxes are categorically invalid as a form of consent.8EUR-Lex. Regulation (EU) 2016/679 General Data Protection Regulation
Put the box at the decision point. Place it on the final screen before a serious action like account creation or payment. A checkbox buried three screens earlier weakens the link between consent and transaction.
Write a specific label. “I agree to the Terms of Service and Privacy Policy” next to the box leaves no ambiguity about what the check means. Vague labels like “Continue” without reference to any agreement do not tie the click to the terms.
Make the links obvious. Hyperlinks to the full text should sit in a contrasting color, conventionally blue, and stand out visually from the surrounding text. The Ninth Circuit noted in Berman that underlining alone may not be enough, and that contrasting font color and capitalization help.4United States Court of Appeals for the Ninth Circuit. Berman v Freedom Financial Network LLC
Block submission until the box is checked. If the user tries to proceed without checking it, show an error message. That both helps usability and creates evidence that consent was a mandatory step.
Keep the linked terms reachable. The full text has to live at a stable URL. A broken link means no real opportunity to review, which is close to no notice at all.
Dark Patterns That Break Consent
The FTC has made clear that manipulative interface design can violate federal consumer protection law. In a 2022 report, the agency described dark patterns as design elements that “obscure, subvert, or impair consumer choice” and listed pre-checked boxes among the oldest examples.7Federal Trade Commission. FTC Report Shows Rise in Sophisticated Dark Patterns Designed to Trick and Trap Consumers In 2023, the FTC ordered Epic Games to pay $245 million in refunds after finding that Fortnite’s interface used confusing button layouts that led players into unintended purchases, and prohibited Epic from charging consumers without affirmative consent going forward.9Federal Trade Commission. FTC Finalizes Order Requiring Fortnite Maker Epic Games to Pay 245 Million
Other problem patterns include bundling unrelated agreements into one checkbox (forcing acceptance of marketing emails alongside the terms of service), using confusing double negatives in opt-out language, and making the “decline” option visually weaker than “accept.” Any design that steers users toward agreement rather than letting them make a genuine choice creates enforcement risk.
When You Change the Terms Later
Most businesses update their terms periodically, and how you handle the update decides whether existing users are bound by the new version.
Courts have found that a clause allowing a company to change terms “at any time and without notice” can render the whole agreement unenforceable. If one party can rewrite the deal at will without telling the other side, the original promise is illusory and there is no real agreement. Courts have described such provisions as placing an unreasonable burden on users who would otherwise have to constantly recheck the website.
Modification clauses are more likely to survive when they commit the company to reasonable advance notice of material changes. When the company gives that notice and the user keeps using the service, courts are more willing to treat continued use as acceptance of the updated terms. The safest approach combines three steps: send direct notice (email is standard) when terms change materially, give users a reasonable window to review before the changes take effect, and require fresh consent for significant updates. Re-displaying the checkbox with a note explaining what changed gives you a far stronger position than relying on continued use alone.
Users Under 18
Checkbox agreements with minors carry extra risk. Minors have a longstanding right under contract law to void agreements they entered, called disaffirmance, and that right applies to digital contracts the same way it does to paper ones. A minor who checked your terms box can later walk away from the agreement and potentially recover money they spent, even after consuming the service.
For children under 13, the Children’s Online Privacy Protection Act requires websites that collect personal information from children to obtain verifiable parental consent before collecting that data.10Office of the Law Revision Counsel. 15 USC 6502 – Regulation of Unfair and Deceptive Acts and Practices in Connection With Collection and Use of Personal Information From Children on the Internet A child checking “I agree” does not satisfy this. Consent must come from the parent, and the method has to be reasonably calculated to ensure the person giving consent actually is the child’s parent.11Federal Trade Commission. Complying With COPPA Frequently Asked Questions An “Are you over 13?” checkbox is not verifiable parental consent and will not protect you in an enforcement action.
Proving the User Agreed
Capturing the consent event is as important as designing the box correctly. If a user later denies ever agreeing, your records are the defense.
Log these data points at the moment the box is activated:
- The exact timestamp of the consent, down to the second.
- The version of the terms the user accepted, so you can tell whether a dispute is governed by version 2.1 or version 4.0.
- The user’s IP address, which helps verify identity and location.
- A unique account identifier that ties the consent event to a specific user.
Keep archived copies of every version of your terms alongside the consent logs. A timestamp is useless if you cannot produce the actual document the user agreed to on that date. Retain the records at least as long as the longest breach-of-contract statute of limitations that could apply. In most states that period runs from four to six years for a written contract, though some reach ten. A cautious retention policy keeps consent records for the life of the account plus seven years after it closes.