I posted an introduction to the AMA, which I am sharing here:

__

Hi everyone, and thanks for joining this Reddit AMA on web scraping! I thought it would be helpful to start with some introductory remarks.

First, and most importantly, a reminder about the ground rule. Nothing in this AMA constitutes legal advice. I will discuss some general legal principles, but I can’t opine how those principles apply to your circumstances. Further, many of the topics we’re going to discuss are contested, and everyone has different tolerances for legal risk. Before you make any decisions, you need to talk with a lawyer about how the law applies to your circumstance and what level of legal risk you’re willing to accept.

Also, as Ian mentioned, I am focused on US law. The rules outside the US could look quite different!

Some background about me: I am an OG Internet Law expert. I got my first email account in 1991, published my first Internet Law paper in 1993, started practicing Internet Law in 1994, and started teaching an Internet Law course in 1996—a course I still teach today, 30 years later. I have been a full-time law professor since 2002.

As an Internet Law expert who formed his intellectual identity in the 1990s, I still approach Internet Law as a generalist, which was the norm back then. I don’t focus on any one topic of Internet Law. Instead, I still track and pay attention to dozens of Internet Law topics. The scraping/trespass to chattels doctrines are just a subset of my overall portfolio of interests. You can see my academic writings at https://papers.ssrn.com/sol3/cf_dev/AbsByAuth.cfm?per_id=332758 Some of my other scholarly priorities include liability for user-generated content (UGC)/Section 230, online trademark law, and emoji law. My forthcoming book project will be about the Internet’s pro-social benefits and how legal regulation jeopardizes those benefits.

Despite my generalist orientation, I find the law of scraping especially interesting. I got my first client question about scraping probably around 1997. When I was in-house, scraping was an evergreen topic. I routinely test on scraping in my Internet Law course. For example, this year’s midterm was based on Vox Marketing Group v. Prodigy Promos, 556 F. Supp. 3d 1280 (2021).

* * *

Part of why I find the topic so fascinating is that I have complicated feelings about scraping from a policy standpoint.

On the one hand, I believe property owners should generally have the ability to decide how their property is used. Scraping can involve unwanted and unconsented uses of a property owner’s property, in ways that can be pernicious.

On the other hand, I believe in access to information. (My mom was a librarian). To the extent that scraping enables better insights, better knowledge, and stronger markets, it’s a social benefit.

Furthermore, the Internet succeeded in part because of its seamless, low-friction, low-transactions-cost navigation. To keep that architecture, browsing the Internet should be a permission-less experience. Anti-scraping doctrines threaten to convert web browsing into a permissioned experience, where there are checkpoints at every site’s perimeter and permission is needed for access. Those barriers threaten to undermine the Internet’s navigability and utility, in ways that will disadvantage all of us.

[Note: Trespass to chattels doctrines are just one way that services can impose permissioned access into web navigation. Copyright law is another. Yet another is the online age authentication mandates sweeping the globe. For more on my opposition to age authentication mandates, see https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5208739 An obvious point: if age authentication checkpoints become ubiquitous in the Internet, that will have major impacts on scraping because most content will live behind age authentication walls].

I have never fully written up my complicated thoughts about these topics, but this piece will give you a sense of my thinking. https://blog.ericgoldman.org/archives/2013/04/rethinking_onli.htm

Here’s how I frame some policy considerations of scraping for students:

On the plus side: Scraping can enable services that create significant social benefits, such as search engines, price comparison bots, and AI modelbuilding. Also, anti-scraping efforts are frequently anti-competitive, i.e., an intent to manufacture or maintain monopolies. In particular, anti-scraping tactics can represent an attempt to obtain IP-like rights, even if the service doesn’t qualify for IP protection. You can see some of these dynamics in the Register.com v. Verio case, where Register.com was using contracts and trespass to chattels to protect non-copyrightable material (WHOIS registrant contact info) to preserve its first-mover-advantage control over that contact information.

On the minus side, scraping can look like a DOS attack (intentionally or not). It can facilitate massive copying, including possibly copyright infringements. And scraping can be a massive invasion of consumer privacy.

So, from a policy standpoint, is scraping a good or bad thing? ¿Por qué no los dos?: Or, to put it into legalese, “it depends.”

* * *

As for the law of scraping, it’s a mess, especially the trespass to chattels doctrines (I summarize them as “TTC”). For about two decades, I taught the Intel v. Hamidi and Register.com v. Verio cases. Around 2024, I felt like those cases no longer reflected the current legal state, so I regretfully took them out of my Internet Law casebook. [For more on the casebook, see https://blog.ericgoldman.org/archives/2026/07/announcing-the-2026-edition-of-my-internet-law-casebook.htm] I have not yet found a good replacement case to add to the casebook, so my casebook coverage of the topic is now adrift. I now teach the X v. Bright Data ruling (the first one granting the motion to dismiss) and it’s not very satisfying. Because there is no good single case or set of cases to teach the topic, and because the law is so unsettled, I tell my students that the topic has become “unteachable.” You can imagine how much they like hearing that LOL.

I teach students to run through a four-step process to determine if/how trespass to chattels applies:

Step 1: does the plaintiff own the affected chattel? Usually, the chattel is the servers or other physical hardware that is used to run the server and connect it to the Internet. The trespass to chattels doctrines are a good illustration of the interplay between the law of physical space and activities taking place in a virtual environment. Students sometimes struggle to wrap their heads around the distinctions between tangible items (i.e., “chattel”) and intangible things, such as data or online accounts, which may be protected by other legal doctrines (copyright or other IP) but don’t legally qualify as the “chattel.”

Step 2: did the defendant “use” the chattel? Usually, sending or receiving packets from a server qualifies.

Created by ChatGPT Dec. 2025

Step 3: was the defendant’s use “unauthorized”? The law might presume that a server owner impliedly permits ordinary Internet traffic merely by making the choice to connect to the open Internet. How can the server owners remove this implied permission? This is one of the areas that is unteachable. There is no clear answer to how a server owner can structure this dialogue with Internet users. Some of the possible tools that a server owner MIGHT be able to use to remove any implied authorization to use their chattel:

• TOSes
• C&D letters
• Technical access controls like registration walls
• Technical access controls like IP address blocking
• Signals such as robot exclusion headers

But, none of these mechanisms are guaranteed to work. This is an area of doctrinal chaos. I’m sure we’ll spend some time discussing if and when those efforts are effective. In general, for each bullet, I have more questions than answers.

Step 4: did the defendant’s unauthorized use create legally recognizable harm? This is also an unteachable aspect because, again, I typically have more questions than answers about what harm will suffice. The court’s flip-flop in the X v. Bright Data case is a good example of how unpredictable this topic is.

* * *

For my students, I summarize the law of scraping with the following tagline: “Scraping is ubiquitous but not clearly legal.” This breaks my students’ brains. If it’s so ubiquitous, it must be clearly legal…right?

In order for a scraping campaign to be legal, we have to navigate ALL of the following doctrines:

• Trespass to chattels. I tell my students that they should always discuss all three of these doctrines as a troika:
  • Federal statutes, especially the Computer Fraud and Abuse Act (CFAA).
  • State statutes, such as the state computer crime laws. Here in California, we focus on Cal. Penal Code 502.
  • Common law trespass to chattels, such as the Hamidi and Bright Data cases.
• Copyright law (106). I spend some time explaining why ordinary web browsing might be copyright infringement because copyrighted material necessarily is downloaded into the browser’s RAM. The students really don’t like that discussion LOL. If web browsing is infringement, then scraping would be as well. In addition to the initial downloading, scrapers might encounter further 106 trouble with republishing some or all of the scraped material.
• Copyright law DMCA (1201/1202). I don’t cover this angle in class yet because it’s too underdeveloped and chaotic, but I’m sure we’ll spend some time on 1201 today. To give you a preview, the 1201 rulings to date break my brain, and I have more questions than answers.
• Many TOSes contain anti-scraping provisions, but it’s not clear if the TOSes are properly formed. In my Internet Law course, we spend a full 2 weeks discussing TOS formation. The law evolved a lot in the 2025 decisions in Chabolla and Godun in the 9th Circuit.

There may be other legal doctrines raised by scraping, such as trademarks and privacy rights.

So here’s why I say that scraping is not clearly legal. In order for a scraping campaign to be permissible, it must survive each and every one of the doctrines enumerated above. If the campaign fails any one of the doctrines, it’s not legal and the scraper can face significant consequences (including, in some cases, criminal liability). It is daunting to build a scraping campaign that can successfully navigate so many legal doctrines perfectly.

* * *

My apologies for such a long-winded introduction (although, I remind you that I’m a law professor, so loquaciousness isn’t really that surprising, is it?) The law of scraping is so complicated and multi-faceted that it’s easy for the discussion to go down rabbitholes or for conversants to talk past each other. I hope this intro provides some helpful structure and context for my more detailed comments.

Thanks again for engaging with the AMA. A blanket apology in advance for all of the times I answer “it depends,” “I don’t know,” or “that’s a good question.” And in all cases, don’t take my word as the final one—talk with your lawyer if you are making any decisions!

The post My Reddit AMA on the Law of Web Scraping appeared first on Technology & Marketing Law Blog.

The opinion summarizes:

As part of its ubiquitous ride-hailing service, Uber permits a user to order “guest rides” for third parties remotely. Guest riders can travel unaccompanied by the user and need never have downloaded Uber’s app orcreated an account themselves. This case concerns what legal obligations a guest rider owes to Uber by virtue of using the service.

In this case, Cheryl ordered an Uber ride for her husband Carroll. Carroll suffered significant personal injuries on the ride. Uber sought to direct Carroll’s claims to arbitration. The court says Carroll never agreed to Uber’s TOS, so no arbitration.

The court summarizes its legal conclusion:

Uber relies on its having sent Carroll a text message before the guest ride that included a hyperlink to the Terms and stated that taking the ride would manifest his assent to them. But Uber cannot show that Carroll ever saw its unsolicited message, and contract law imposes no duty to read a contract that one does not know exists. Uber alternatively submits that Carroll could be separately bound to arbitrate his claims under Cheryl’s contract with Uber. Carroll does not seek to enforce his wife’s contract, however, and he had no more notice of its terms when he took the guest ride.

Why Didn’t the Text Message Work?

Uber texted Carroll:

Your Uber from Cheryl is arriving in 10 minutes. \n \nBy taking this trip, you agree to the Uber Terms of Use & Privacy Policy: t.uber.com/lgl. \n n\Track here/nhttps://trip.uber.com/Wu8vBbIYEf3A \n\nReply STOP to opt out from SMS notifications.

The court says that Carroll did not have inquiry notice:

Under the design of Uber’s guest-rider system, it never required Carroll to click on an “I accept” button or its equivalent, or to otherwise expressly confirm his acceptance of the Terms. Nor was Carroll presented with a website- or app-based interface that contained a link to the Terms and stated that taking the ride would manifest his assent to them. Instead, Uber simply sent Carroll a text message with that information and anticipated he would see it before taking the ride. But individuals are not on inquiry notice when they must “ferret out hyperlinks”—even when they are already using the apps or webpages on which the links appear….In focusing on the layout and language of the text message it sent Carroll, Uber skips over a critical difference between this case and the mine run of internet-contracting cases: Carroll never saw the message, so it is irrelevant whether he would have been on inquiry notice from the message had he seen it.

Uber suggested that Carroll surely saw its text. The court responds:

The system Uber designed did not require guest riders to read the text messages Uber sent them before using the service. Nor did its system as a practical matter require guest riders to open the messages to obtain information about their rides…

we disagree that an objectively reasonable person in Carroll’s position necessarily would have read the text message from Uber before taking the guest ride….At least until they enter the vehicle, the guest rider’s relationship to Uber’s service is entirely passive; they need never have interacted with the company in any way. In that context, it is far from apparent that a reasonable person would expect to receive an unsolicited text message calling for them to examine voluminous contract terms in the short window before their ride arrives. And although Carroll’s practice of never reading text messages may be idiosyncratic, there is no legal duty to perpetually monitor one’s phone for incoming messages that may contain contract terms interspersed with other text.

“Never reading text messages” sounds like aspirational goals for many of us.

Other Ways of Binding Carroll

Carroll isn’t a third-party beneficiary of Cheryl’s TOS with Uber. “Carroll is not seeking to enforce Cheryl’s contract with Uber, nor did he otherwise consent to be bound by its terms….if Carroll was an intended third-party beneficiary of the contract between Cheryl and Uber, that would simply mean he could sue Uber to enforce its obligations to Cheryl. That is a far cry from saying he incurred his own obligations to Uber from a contract to which he was not a party.”

Also, “Even assuming the guest ride counts as a direct benefit that Carroll accepted under Cheryl’s contract with Uber, Uber’s [equitable estoppel] argument still fails. We have explained that Carroll lacked actual or constructive notice of the terms on which that benefit was being offered, so he did not “knowingly” accept any benefit.”

What Could Uber Do Differently?

In my Internet Law course, I describe a phenomenon of TOS formation “leaks,” where people can reach their desired goal without going through the otherwise mandatory TOS formation process. Uber guests are an example of such a leak in Uber’s TOS formation process.

Uber will always have a problem binding every rider to a TOS (and thus arbitration). If an Uber member requests a ride that includes unrelated individuals, Uber doesn’t know who the additional passengers are or have any direct contact with them sufficient to form a TOS with them. Thus, Uber inevitably has limited arguments to divert non-members into arbitration.

In this respect, Uber is in a better position to bind Uber “Guests.” If Uber gets an order for a guest, it could cancel the ride unless the guest agrees to the TOS, such as requring the guest to reply to its text (as the court says, “Uber, for instance, could require guest riders to confirm receipt of the Terms by responding to its text message”) or clicking through some TOS offer screen before the guest order is confirmed. However, I doubt these options would be very popular. For example, guests may not have a cellphone or may have some infirmity that explains why third parties are handling their affairs.

Alternatively, Uber could put the burden on drivers to ensure that everyone who gets in the car has agreed to Uber’s terms somewhere/somehow.

First, Uber could require everyone ordering a ride to specify the identity of riders and their contact info, and then confirm them like the guest protocol I mentioned above. This would require drivers to then block access to guests who didn’t assent to the TOS. I don’t think anyone would love this solution, including drivers who might face physical threats for denying rides or potentially leave people stranded in dangerous situations.

Second, Uber could put some kind of TOS disclosure on car windows, such as “by entering this vehicle, you agree to the TOS.” (Call it a…window-wrap?). Putting aside the legal dubiousness of a window-wrap, it would require drivers to implement this properly on their cars, and the odds of that are prohibitve. (Also, a car usually has multiple doors, and each one would need the disclosure if the window-wrap were to work against everyone).

In sum, it’s quite possible that Uber may never be able to bind all riders to arbitration. Then again, I don’t recall taxi services in their day routinely being able to bind their riders to arbitration either.

Case Citation: Walker v. Uber Technologies, Inc., No. 24-7154 (D.C. Cir. Aug. 28, 2026)

* * *

Schlueter-Beckner v. SimpliSafe, Inc., No. 25-4933 (9th Cir. Aug. 31, 2026)

SimpliSafe’s TOS formation via a sign-in-wrap failed for lack of visibility. The Ninth Circuit doesn’t show the screen, but the lower court opinion included this:

The Ninth Circuit first explains why it focuses only on the bottom “place order” widget, not the one on the right:

Because the fill-in items that required action and attention from the consumer were all in the left-hand column, the overall design of the page deemphasized the right column and drew focus toward the “Place order” button at the bottom of the left column. This emphasis is reinforced by the fact that the preceding “Shipping” webpage in the purchase process similarly placed the fill-in items on the left-hand side, with a similar blue action button at the bottom. Moreover, SimpliSafe presented no evidence to show that Plaintiffs must have used the “Place order” button on the right-hand side or must have read the disclosure on that side to finalize their purchase. Therefore, any insufficiency with the bottom disclosure—which may have been the only disclosure the user saw—would mean SimpliSafe failed to show its webpage provided reasonably conspicuous notice.

Then, the Ninth Circuit says that the bottom TOS offer isn’t prominent enough:

The disclosure’s placement, font size, and font color drew the user’s attention away from the disclosure. There was significant white space between the disclosure and the “Place order” button; the text of the “Place order” button was seemingly twice the size of the disclosure’s text; and the “Place order” button contrasted more against the white background than the disclosure’s gray text….

Go back and double-check the white space between the TOS offer and acceptance button. Seriously?

The court continues:

Above the bottom disclosure, the purchasing webpage includes a line of text warning users their credit card information would be automatically saved to the account for future use. This warning is in larger font than the disclosure, italicized, and in navy text against the light gray background. As a result of these design choices, the credit card notice contrasts starkly on the page and draws the eye. So, while SimpliSafe utilized design elements to ensure the user saw the warning aboutretaining credit card information, “they have not done the same to alert a consumerto the Terms of Use.”

Would you say that the credit card warning was so much more prominent than the TOS offer?

Some plaintiffs also signed up for alarm monitoring, and that signup process failed too. The TOS offer labeled the TOS “SimpliSafe Terms and Consent to Communicate, for Notifications and Alerts.” The court said that sounds like the TOS only related to SimpliSafe’s messages, not a more comprehensive set of TOS terms.

Also, the TOS offer and acceptance button didn’t match:

the disclosure stated “[b]y submitting this number” Plaintiffs agreed to the terms, but the action button on the webform only stated “Next.” This mismatch of terms could easily confuse users.

As I”ve said before:

* * *

Uhl v. Roblox Corp., No. 25-5057 (9th Cir. Sept. 3, 2026)

Roblox’s TOS contains an arbitration clause but “Roblox did not move to compel arbitration—for months on end.” Roblox claimed it needed to know the plaintiff’s username to determine if the case was arbitrable, but Roblox didn’t seek any discovery to resolve this ambiguity. Instead, it litigated the preliminary stages of the case in court, including a removal motion, a remand, and a substantive motion to dismiss.

This makes it look like Roblox sandbagged the arbitration issue. The majority summarizes:

a party cannot ask the district court to dismiss a complaint on the merits, holding in reserve a claimed right to arbitrate that will be exercised only if it does not like the district court’s decision.

Judge Bumatay (a TAFS judge) dissents, saying the law wasn’t settled or clear that Roblox was waiving its arbitration rights by proceeding as it did.

The post Uber Guests Aren’t Bound By Uber’s TOS–Walker v. Uber appeared first on Technology & Marketing Law Blog.

In response, the firm sued her for defamation and breach of contract. The firm enumerated seven allegedly defamatory statements, including “They are either scam artists or complete crooks” and “They are not tough, they are not effective and they will rob you blind.” The lower court held these statements were nonactionable hyperbole and the author’s opinion. Other claims failed because the firm didn’t show they were false.

With respect to the contract breach, Section 16 of the firm’s fee agreement said the parties “agree not to directly or indirectly disparage each other either electronically or otherwise.” Because of this, Yelp has flagged the firm’s Yelp business page with a “Questionable Legal Threats” warning:

The link goes to the full text of the Superior Court opinion in this case.

As every lawyer knows, suing a client entails substantial risk of blowback, including possibly a malpractice claim and a complaint to the state bar. Here, the law firm gets other unwanted consequences. Sedgwick successfully brought an anti-SLAPP motion to strike, which means the firm will be paying her legal fees.

The appeals court upholds the anti-SLAPP dismissal, saying “we readily agree with the trial court that the Yelp review criticizing the firm’s representation of Sedgwick is protected activity.” The appeals court adds that “calling someone crooked is ‘merely rhetorical and hyperbolic language’ and not defamatory.”

Of particular note is the court’s treatment of the fee agreement’s non-disparagement clause. The law firm equated disparagement with defamation, so the court said the contract breach claim failed when there was no defamation. The appeals court adds:

Section 16 violates Civil Code section 1670.8. That statute provides: “A contract … for the sale … of consumer goods or services may not include a provision waiving the consumer’s right to make any statement regarding the seller … or its employees or agents, or concerning the goods or services.” By its plain language, it precludes a provision that, like Section 16, purports to require Sedgwick “ ‘not to directly or indirectly disparage’ ” the firm.

We do not share the firm’s concern that this statute “would negate existing law and permit consumers to defame businesses … with impunity.” The statute cannot be reasonably read to immunize defamation. In our context, the statute does not prevent the firm from suing for defamation, if the firm could prove defamation sufficiently to survive an anti-SLAPP motion. The statute merely prevents the firm from including Section 16 in its fee agreement—or thereafter enforcing it.

I haven’t exhaustively researched the issue, but I couldn’t think of a prior court finding a 1670.8 violation. It’s 2026, and I can’t believe anyone–especially a law firm–still doesn’t know that contractual efforts to restrict consumer reviews are no bueno.

I’ve complained about the spate of bogus 1670.8 “drive-by” litigation that is clogging our courts, but here is a real-life bona fide example of an actual genuine 1670.8 violation. Review suppression like this is what the drive-by lawyers should be enforcing, not their current tendentious and tortured reading of TOSes.

The argument that the law firm needs a contractual anti-disparagement clause to prevent defamation is specious. If a client posts a defamatory review, defamation law applies–no contract overlay needed. I discuss that issue more in this post.

It would have been more interesting if the firm had claimed that the contract anti-disparagement clause applied even if there wasn’t any defamation. But 1670.8 would kick in, mooting that claim as unenforceable.

Case Citation: LS Carlson Law PC v. Sedgwick, 2026 WL 2410113 (Cal. App. Ct. August 17, 2026)

BONUS: Greenwich Building Company v. Hoots, 2026 WL 2408839 (N.Y. Supreme Ct. August 11, 2026). A real estate company sued a property buyer for negative reviews on Google and Houzz. The court finds the lawsuit was covered by New York’s anti-SLAPP laws. The court says “online review forums such as Google and Houzz have consistently been held to be public forums under New York’s anti-SLAPP law…The statements are of interest to members of the community who may consider buying or renting an apartment at 120 Java Street.”

The court then says the plaintiff showed a substantial basis for its defamation claim because there is some confusion about the identity of parties (the buyer’s complaints may relate to a different, though possibly, related company).

And yet, the plaintiff didn’t adequately show the buyer had actual malice: “Defendant left his reviews on plaintiff’s Google and Houzz pages after diligent pedestrian online research….defendant’s statements specifically on those online review pages appear to have been the result of an honest mistake and that defendant left his reviews on plaintiff’s pages after a good faith attempt to find the correct pages to leave such reviews….This court too chooses to err on the side of non-actionability in this case so as to promote the public’s right to free speech.”

As a result, the case is dismissed, and the defense will get its attorneys’ fees.

Selected Blog Posts Regarding 1670.8

• Another Court Shuts the Door on “Yelp Law” Drive-By Lawsuits–Arterberry v. Peet’s
• Appeals Court Shuts Down Bogus Private Enforcements of the ‘Yelp Law’–Moss v. GoDaddy
• Catching Up on the Bogus “Yelp Law” Litigation Campaign–Tao v. Uniqlo
• Amazon Must Defend “Yelp Law” Claim–Ramos v. Amazon
• Courts Are Rejecting Attempts to Weaponize Laws That Protect Consumer Reviews
• Businesses Cannot Contractually Ban “Abusive” Consumer Reviews
• California Tells Businesses: Stop Trying To Ban Consumer Reviews (Forbes Cross-Post)

The post Lawyer’s Fee Agreement Gagging Client Reviews Is Illegal–LS Carlson Law v. Sedgwick appeared first on Technology & Marketing Law Blog.

“Grok, is it bad when TOS formation fails?”

“Grok, what are best practices for TOS formation and does our current TOS formation process satisfy those?”

* * *

The plaintiff claims Grok “disclosed private and confidential information.” Grok sought to transfer the case to N.D. Tex. per its TOS forum selection clause. Everyone agrees the case should transfer if the TOS was properly formed. It was not.

The Wrap Taxonomy

Here is the applicable TOS formation screen at account signup. Everyone agrees this is a sign-in-wrap.

Here is the screenshot when Grok users submit queries:

The court says the chat screen is closest to a sign-in-wrap as well.

Thus, the court follows the now-standard Chabolla framework for reviewing sign-in-wraps.

Transaction Context

Unhelpfully, the parties obviously didn’t think this factor was important:

the Parties devote little space to addressing the transactional context at play here. Defendant offers one sentence in a footnote in its reply brief, citing to Oberstein and contending that “signing up for an account is the type of transaction that contemplates an ongoing relationship.” Plaintiff does not discuss this issue.

This raises another question for Grok: “Grok: is it good when a litigant fails to provide advocacy for one of the elements the court will analyze?”

The court says the plaintiff should have assumed there were applicable terms:

The first factor is that, although an account is “not required” to use Grok, Plaintiff chose to make one anyway. The second is that, after making that account, Plaintiff used Grok repeatedly “throughout 2025 and 2026” to “enter[] queries related to sensitive information about finances, investment strategy, private health conditions, business projects, and other private information.” In the Court’s view, a user who affirmatively chooses to make an account when doing so is optional and recurrently uses the corresponding web service should reasonably contemplate “some sort of continuing relationship” accompanied by terms and conditions. That Plaintiff used Grok to discuss sensitive personal information also weighs in favor of the notice requirement.

From my perspective, anyone who voluntarily chooses to use Grok extensively has placed themselves into a caveat emptor situation. It’s like the Farmer and the Snake parable.

Reasonable Notice on the Sign-Up Screen

The court then turns to the visibility of the TOS offer language, starting first with the sign-up screen. The court says there is a visual discontinuity between the TOS offer and the acceptance buttons:

although a reasonable user is presented with four sign-up methods, he ultimately selects only one. Having made that selection, the other sign-up options necessarily become “superfluous.” Even if a user chose the sign-up option closest to the bottom of the webpage (the option to “Sign up with Google”), Defendant’s contention that the notice is “positioned immediately below” is still incorrect. The language that is directly below the “Sign up with Google” button reads: “Already have an account? Sign in[.]” A reasonable user who is on Defendant’s sign-up page to sign up for a Grok account, which is how Defendant contends Plaintiff agreed to its terms, would likely see that text and read no further because, by definition, it does not pertain to him

The court is doing some tricky but important work here. Basically, she’s saying that once a user encounters language that isn’t applicable to them, they will stop reading and proceed. So here the “Already have an account? Sign in” language acts as a visual barrier that moots everything below it for a user who is signing up for the first time. Perhaps if the TOS offer language were closer to the buttons and more prominent, it could have overcome that visual barrier. But putting the language above the sign-up buttons would have avoided this limitation. (Or, better yet, two clicks).

The court doesn’t like the TOS offer language presentation either:

The contrast between the white hyperlink and the black background is notable, but it says nothing of the contrast between the hyperlink and the text immediately adjacent to it….the difference between light gray and white is a matter of degree and hardly one that maximizes visibility. Moreover, any distinction that this color variation provides is offset by the fact that other non-clickable text such as the “Create your account” heading is also in white…. the single colorful feature—the multi-colored Google logo on the “Sign up with Google” button—is near the center of the screen, likely drawing a reasonable user’s attention more than the monochromatic notice text at the bottom of the page does

I guess the judge doesn’t love monochromatic screens as much as Musk does?

The court summarizes:

Although the transactional context suggests that Plaintiff should have expected to be bound by contractual terms, the Court finds that the sign-up screen notice is not reasonably conspicuous because of “the notice’s distance from relevant action items, its placement outside of the user’s natural flow, and its font—notably timid in both size and color.”

I’m still waiting for courts to clarify what the “user’s natural flow” means. It brings to mind the great Dave Mason song (RIP).

Chat Screen TOS Formation

The chat screen formation evaluation doesn’t fare any better (and maybe a little worse?):

it is patently untrue that the notice is “directly beneath the query box.” Nothing is directly beneath the query box except a lot of empty space. Moreover, the query box is the only action item on the chat page, and as such a user’s “most obvious and natural next step” is to input text into that box. Because the query box is on the top third of the page and no additional graphics or text give the user any reason to look beyond it, the notice at the bottom of the website is “buried” beyond “the periphery” of where a user would be looking.

A “lot of empty space” “buries” the TOS offer language.

The court also noticed the lack of underlining to signal the link: “The only factor distinguishing the hyperlinked text and the adjacent text is the font color, and, as the Court noted, white and light gray are not “contrasting font colors.””

X pointed to a long list of court cases upholding its TOS formation. The court says there were factual differences in all of those cases. I imagine this will be contested on appeal.

Implications

One more question for Grok: “Grok, after reading this opinion, please suggest the six most important changes we should make to increase the likelihood of TOS formation.” The list would be trivially easy to implement; and there’s no reason Grok waited this long to figure it out.

This opinion is a good example of how Chabolla expedites the TOS formation failure in screens like this. This implementation was possibly marginally passable pre-Chabolla. Now, in my opinion, it’s clearly deficient, but in easily avoidable ways.

Case Citation: Skaggs v. X.ai, LLC, 2026 WL 2352969 (N.D. Cal. August 13, 2026). Defense counsel in this case is Kenneth Michael Trujillo-Jamison, Willenken LLP.

* * *

BONUS: Trimble v Entrata, Inc., No. 25-1975 (4th Cir. Aug 11, 2026).

This case involves the RentalPortal service, which allows tenants to pay their rent but charges a convenience fee for the pleasure of doing so. It sounds like RentalPortal used a clickwrap: “Although users could not finalize their rent payments until they had checked the box indicating their agreement to the Terms, they were not required to click on, scroll through, or otherwise actually review the hyperlinked Terms.”

Tenants sued for the convenience fee collection. RentalPortal moved to send the case to arbitration. TOS formation isn’t at issue. Instead, the plaintiffs challenge consideration.

In an echo from Harris v. Blockbuster from 2009 and the more recent Johnson case, a majority of the panel (over a dissent by Judge Rushing) says the arbitration clause is illusory because “Appellant’s Terms include a Change Clause that expressly gives it the unfettered discretion to unilaterally modify the arbitration agreement without any meaningful limitation.”

The change clause reads:

At [ResidentPortal], [users] are bound by the version of this Agreement that is in effect on the date of [the user’s] visit. This Agreement may change from time to time, so please review it when you visit [ResidentPortal].

The majority says:

Under a plain reading, a person who visits ResidentPortal is automatically bound by the Change Clause the moment ResidentPortal is accessed. The fact that users must click the assent button as part of the user interface in order to make rental payments does not alter the fact that any user paying rent is already bound by any modified terms merely by visiting ResidentPortal in the first instance. We have repeatedly held this type of “change in terms” clause to constitute an illusory promise under Maryland law….

there is no language in the Change Clause here requiring Appellant to provide its users with notice before or even after modifying the terms….

the Notices Clause states that any notices Appellant chooses to provide will be posted to ResidentPortal. But it also provides that the Terms automatically apply if and when Appellee visits ResidentPortal. So, there was no way for Appellee to receive notice of modifications or review them without automatically assenting to them. Therefore, the purported ability of Appellee to opt out of accessing the website and thereby decline the modified terms is illusory because it exists solely at Appellant’s pleasure…

it is entirely in Appellant’s discretion to modify the Terms, and the only restriction on that authority is Appellee’s choice to access ResidentPortal to pay her rent — which is no choice at all, as she is automatically bound by the version of the Terms posted the moment she accesses the website, even though at the time she accesses it, she would not know whether there is any posted notice of new Terms.

The majority concludes:

because the Terms here “allow[ed] [Appellant] to escape all of its contractual obligations at will” and did not provide Appellee with effective notice of any modifications, the agreement to arbitrate here is precisely the type of promise we have previously found to be illusory under Maryland law

Arbitration denied.

Given what we learned in Harris v. Blockbuster 17 years ago, it’s incredible that in 2026 we’re seeing these kinds of TOS amendment implementations. Any TOS amendment clause that purports to permit TOS amendments without actual notice to the users is a toxic provision for the entire TOS. Here, RentalPortal can easily form a new contract through a clickwrap each time the user pays rent, so this outcome was incredibly easy to avoid.

The post Grok’s TOS Formation Failed–Skaggs v. X.ai appeared first on Technology & Marketing Law Blog.

Consumer Consent

LinkedIn’s own disclosures may be sufficient (see LB v. LinkedIn in my prior post), but its partners’ disclosures are not. Covered California’s disclosures expressly say “no personal information is sold or distributed,” and Nevada Health Link’s disclosures do not mention sharing data with third parties.

Furthermore, “Courts have often found a lack of consent when the type of data collected, though conceivably included in the disclosure, falls outside the plaintiffs’ reasonable expectations.” LinkedIn capturing consumers’  “medication and dosage” would be outside such expectaions. The complaint against Covered California was not specific enough about its data captures, but that can be fixed in an amended complaint.

LinkedIn’s Intent to Intercept

Johnson alleges that LinkedIn intentionally intercepted her and class members’ communications regarding their medical care through the Insight Tag, which Johnson alleges LinkedIn designed to collect all interactions with the Nevada Health Link website. Johnson also alleges that the issue of health information being shared via tracking technology is so well known in the technology industry that LinkedIn should have known its Insight Tag was likely collecting personal health information. Finally, Johnson alleges that LinkedIn monetized the intercepted personal health information in the form of targeted advertising, which is most of LinkedIn’s revenue. Though the inference of intent may be relatively weak in light of LinkedIn’s policies to the contrary and the absence of specific facts concerning how LinkedIn uses the data it allegedly receives from the Insight Tag, the Court finds these allegations sufficient to survive a motion to dismiss

So…the court says LinkedIn has sufficient “intent” to intercept sensitive consumer data even if its contract with customers restricted such efforts, because LinkedIn should have known data leakages would occur? That doesn’t sound like “intent” to me. See the Pharmatrak case from 2003…

LinkedIn argued that the Nevada Health Link is a government agency, so it should be entitled to the presumption of regularity, i.e., that it followed its own policies and the LinkedIn agreement. The court says that presumption, if it applies at all, is more of an evidentiary burden, not a legal matter that supports motions to dismiss. Plus, Johnson alleged a wrongful data collection of their data, regardless of the entities’ general policies.

Intrusion Upon Seclusion

LinkedIn fails to provide any support for its argument that the “amount” of information disclosed, the public availability of the website, or the optional nature of some forms are relevant to the degree of intrusion or otherwise cause the context, circumstances, and setting factors to tip in LinkedIn’s favor. For purposes of the motion to dismiss, the Court finds Johnson’s allegations that LinkedIn’s unauthorized interception of information regarding her medication and dosage was “highly offensive” conduct sufficient.

Based on my unscientific review of the Pixel cases, it seems like the lawsuits against healthcare entities frequently survive motions to dismiss. It will be an entirely different matter for plaintiffs to win the cases and defend those rulings on appeal.

Case Citation: Doe v. LinkedIn Corp., 2026 WL 2199526 (N.D. Cal. July 30, 2026)

More Posts on the Pixel Cases and Related Claims

• Third Circuit Rejects a Meta Pixels Case–Cole v. Quest Diagnostics
• The Wrap Taxonomy Vexes the Judge in the LinkedIn Insight Tag Cases
• The Second Circuit Is Done With Meta Pixels VPPA Cases–Hughes v. NFL
• Court Rejects Trespass to Chattels Claim Over Placing Cookies–Doe v. Tenet
• Clickwrap Formed Even When a Consumer Has Limited Time to Act–Washington v. Flixbus
• Meta Pixels Case Dismissed by Second Circuit–Solomon v. Triller
• Leaky TOS Formation = No TOS Formation–Snyder v. G6
• The VPPA May Be a Dinosaur Statute, But It’s Very Much Alive in the Second Circuit–Salazar v. NBA
• Pixel Case Against Google “Jumps the Shark”–Doe I v. Google (Catch Up Post)
• Think You Understand Online Trespass to Chattels Law? Think Again–In re Meta Healthcare Pixels
• More Chaos in the Law of Online Contract Formation
• Privacy Lawsuit Based on Website Tracking by Service Provider Trimmed

The post LinkedIn’s Insight Tag Creates Legal Entanglements–Doe v. LinkedIn appeared first on Technology & Marketing Law Blog.

Created by ChatGPT Dec. 2025

by guest blogger Kieran McCarthy

I recently described the district court’s decision in the case of Amazon v. Perplexity as “a shockingly poor effort to grapple with CFAA applicability to agentic AI technology.”

The Ninth Circuit appears to have agreed.

This week, the Ninth Circuit panel published its opinion vacating the district court’s preliminary injunction and remanding for further proceedings. Amazon.com Services, LLC v. Perplexity AI, Inc., 2026 WL 2237587 (9th Cir. Aug. 4, 2026).

The panel determined that Amazon was not entitled to a preliminary injunction because it was not likely to succeed on the merits of its CFAA claim. The court concluded that Perplexity did not “access” Amazon’s computers within the meaning of the CFAA, but rather it was the user who accessed Amazon’s computers. The panel also concluded that Amazon was equally unlikely to succeed on the merits of its CDAFA claim for the same reasons.

The panel also concluded that the remaining equitable factors favored Perplexity.

The Court kept its opinion narrow and specifically disclaimed the applicability of this opinion to other facts or other laws related to data access and agentic AI. But this was a nonetheless important step in distinguishing the infamous Power Ventures opinion, at least in the context of agentic AI.

—

I described the facts in detail in my prior write up of the district court’s decision, so I won’t rehash them here.

But unlike at the district court, the Ninth Circuit panel did not ignore the key factual pattern that makes this case so interesting. What’s unique and interesting about this case is that it involves a fundamentally new technology, in the form of Agentic AI, acting on the instructions of end users.

The panel wrote:

Agentic AI is an emerging technology. There is thus little to no existing caselaw directly dealing with how to ascribe responsibility for AI agents like the Assistant, let alone caselaw specifically dealing with agentic AI in the CFAA context. And CFAA cases dealing with more established technologies do not provide a perfect analogue to the case at hand.

Id. at 12.

The panel then went on to distinguish the facts of both Power Ventures and BrandTotal (both cases involving Facebook, ironically enough).

And the key distinguishing fact, according to the panel, was that on the facts presented to the Court, it was not Perplexity that was accessing Amazon’s computers, but rather the end users through their computers.

Under the CFAA’s plain language, Perplexity’s Comet Assistant itself cannot “access” Amazon’s servers.

According to the Court:

However advanced the Assistant currently is, it is a tool, not a person for statutory purposes. See 18 U.S.C. § 921(a)(1) (“The term . . . ‘whoever’ include[s] any individual, corporation, company, association, firm, partnership, society, or joint stock company.”); see also Whoever, Cambridge English Dictionary, [https://perma.cc/YY3TVTJF] (last visited July 16, 2026) (“[T]he person who” (emphasis added)).

Id. at 15.

Since it is the user using the Assistant tool, Perplexity’s not accessing Amazon’s servers in the first place. And the entire CFAA case unwinds after it reaches that conclusion.

The Court further reinforced its conclusion with the rule of lenity (which courts that enforce the CFAA always seem to forget). The Court was concerned that under Amazon’s theory of liability, end users could be exposed to criminal liability for using agents. Given the rapid adoption of this new technology, the Court was concerned about that approach.

But with just as much caution, the Court was equally quick to reiterate what the opinion was not.

We do not establish a new legal regime governing agentic AI. We do not address whether in other contexts, including tort claims, Perplexity can avoid liability for the Assistant’s actions. Our holding here is limited to “access” as contemplated by the CFAA and as applied to the Assistant’s interactions with Amazon.com on the record before us, not the broader landscape surrounding agentic AI.

Id. at 17.

—

The Court’s reasoning was largely identical in the context of the CDAFA, even though, as I noted in the prior district court opinion write up, the CDAFA is broader than the CFAA. Even though the CDAFA is broader, the “focus of the inquiry is still on the person accessing or causing the access.” Id. at 18. And since the panel concluded that it was not Perplexity that accessed Amazon’s servers, but rather end users through their own computers, that was that.

—

Once the panel determined that Amazon was unlikely to succeed on the merits, the district court’s thin and largely circular conclusions on the other equitable factors unraveled quickly.

In the end, the Ninth Circuit panel kept its opinion tight and focused on the primary issue in the case: whether Perplexity’s agentic AI tool was a “person” who accessed a site within the meaning of the CFAA. It is not, and the case has been remanded for further proceedings in light of that conclusion.

The case avoiding sweeping pronouncements and it was not the straight-up revocation of Power Ventures that some might have hoped for. Given the other legal issues presented, Perplexity might not be out of the woods just yet, but it’s fair to say that the Ninth Circuit vacated bad legal precedent and replaced it with a better one. And for that we can be thankful.

* * *

Eric’s Comments

In the copyright module of my Internet Law course, I ask students a simple question: is web browsing infringement and, if so, by whom? I use the Cablevision case to review the question. (In that case, the court held that for a DVR-as-a-service business, the users pressed the button to make the storage copies). The whodunit question blows students’ minds because it’s 2026 and they assume these issues have long been resolved. As this case shows, courts are still unsure who takes the legally significant actions online.

The ruling also brought to mind the Ticketmaster v. RMG case (the 2007 Hannah Montana case), which I still teach today. The facts in that case remain murky to this day, but I always interpreted RMG as handing off its software to its ticket broker customers, who then operated the software to snipe scarce event tickets, but with some ongoing facilitation from RMG (like relaying ticket purchase requests through a phalanx of RMG-associated IP addresses to reduce blockage). Ticketmaster successfully prevailed over RMG in that case on several legal theories, but does this court’s reasoning suggest that Ticketmaster’s redress should come solely from RMG’s customers, not RMG? Or does the RMG case suggest Amazon ought to win against Perplexity, just under other legal theories?

In support of that latter prospect, the opinion invites courts to more closely scrutinize exactly what the providers of agentic AI software do to facilitate their users’ activities. If they cross some undefined and currently invisible line, the software provider will transform into the legally relevant actor. That might harmonize this ruling with the RMG and Cablevision cases, but at the cost of inconsistent judicial outcomes and high defense costs.

As with other whodunit cases, if Perplexity is off the hook, where does that leave Perplexity’s users legally? Could Amazon assert CFAA/502 claims against users, or a range of other legal theories? In a footnote, the court says tersely: “This outcome does not impair Amazon’s ability to regulate access to Amazon.com via private terms of service for its users.”

The users’ legal exposure highlights some challenging policy fault lines of this case–and all online trespass to chattels cases. On the one hand, it would be a bad thing if websites more aggressively erect contract-based putative barriers to access. That creates a potential thicket for ordinary daily activities, and it raises greater risks that individuals will unintentionally trigger significant legal exposure if they don’t research and confirm their permission to visit every service they visit.

On the other hand, Amazon clearly expressed its preferences that it didn’t want Perplexity’s users to access its services through agentic AI, and why shouldn’t the law back up these strong and clear desires? We know that server operators need that prerogative to fend off hostile attacks, but we also know server operators will overclaim any legally backed prerogative they have.

As a result, as with most trespass-to-chattels cases, there are not likely to be any easy answers in this case. There are only significant and potentially problematic policy tradeoffs.

The post Ninth Circuit Lifts Restrictions on Agentic AI Accessing Amazon appeared first on Technology & Marketing Law Blog.

In short, California enacted the “Yelp Law” to restrict businesses from trying to stop their consumers from posting online reviews. The statute is divided into two main operative parts. (a)(1) targets TOS provisions that restrict consumer reviews. (a)(2) targets businesses’ efforts to enforce those TOS provisions. A small team of plaintiff lawyers have been cruising the Internet, looking for TOS provisions that they claim are consumer review restrictions, and then asserting (a)(1) violations for those TOS provisions hoping for payoffs. In these enforcements, no consumer has actually been stifled in their remarks (that would support an (a)(2) violation). Worse, the plaintiffs’ lawyers often fail to display basic reading comprehension because their claims target generic and standard TOS provisions that have nothing to do with consumer reviews.

[In this case, the offending TOS provisions said that consumers “agree not to submit content to the website “‘intended to cause commercial harm’” to Peet’s or to use Peet’s trademarks “‘in any manner … that would disparage’ Peet[’s] products or brands.” These are ill-advised TOS provisions that should be rewritten, but they are also clearly not meant to restrict consumers’ abilities to post reviews.]

The Moss decision rejected similar claims because the court concluded (a)(1) had no private right of action. However, that decision was non-precedential. Now, a week later, a different California Appeals Court panel reaches the same conclusion in a precedential opinion, Arterberry v. Peet’s. The end of the Yelp Law drive-by enforcements is getting closer.

The Arterberry opinion summarizes its question and answer:

May a consumer seek monetary penalties against a company for including a contractual provision made illegal under section 1670.8 as part of the terms and conditions on its website, even if the company never threatened to enforce that provision or take any action against the consumer? We hold section 1670.8 outlaws non-disparagement clauses in consumer contracts, but it unambiguously allows a consumer to bring a suit for monetary penalties only when a seller attempts to enforce such a provision or otherwise seeks to penalize a consumer.

The Arterberry opinion itself doesn’t mention the Moss opinion (which was non-precedential, and the opinions were likely drafted in parallel with each other), and the Arterberry opinion claims it is addressing a matter of “first impression” (with acknowledgements of the Shofet and Anderson federal district court opinions, neither of which bind the court, but no acknowledgement of Moss). Despite the parallel rulings, Arterberry follows the same basic logic as the Moss opinion.

The Arterberry opinion engages in a little more depth with the legislative history. The court concludes:

Section 1670.8 applies to everyone, be it a Fortune 500 company or a small family business. If, as the plaintiffs allege, the use of a nondisparagement clause created a cause of action with respect to each California resident who visited a website, with a civil penalty of up to $2,500 for each such resident, then a relatively small business with 10,000 online California customers would face up to $25,000,000 in penalties for using insufficiently precise content moderation and trademark enforcement language in the terms and conditions of its website. The same business would face no more than $5,000 in penalties for actually threatening or seeking to penalize a consumer for posting a negative review. In the more than 400 pages of legislative history that the plaintiffs submitted for our review, we see nothing to suggest the Legislature intended the statute to work this way.

(To be fair, a $5k financial deterrent against suppressing consumer reviews may be too light, just as a $25M penalty for poor TOS drafting would be way too heavy. But the Yelp Law doesn’t rely solely on a private right of action; the AG’s office can enforce it too).

As I mentioned in my prior post, the mere presence of anti-consumer review clauses in TOSes could potentially chill consumers from posting reviews, even if the business never affirmatively asserts that clause. Other laws may redress that concern. And either way, the current batch of (a)(1) enforcements are not the right solution.

I wonder if the unsuccessful plaintiffs’ lawyers will ask the legislature to “fix” the statutory drafting, claiming that the courts have left consumers vulnerable to businesses’ anti-review efforts. It’s the kind of story that some legislators would be sympathetic to–if they don’t do their homework about the abuses already taking place. Even without a legitimate private right of action, plaintiffs’ lawyers have used (a)(1) to cause chaos in court and extract undeserved concessions. We need less of that, not more.

Case Citation: Arterberry v. Peet’s Coffee, Inc., 2026 WL 2185136 (Cal. App. Ct. July 29, 2026)

BONUS: A Pennsylvania court dismissed a class action lawsuit against Ikea based on the Arterberry precedent. Hinton v. Ikea North American Services LLC, 2026 WL 2984984 (Table) (Pa. Superior Ct. Oct. 5, 2026)

Selected Blog Posts Regarding 1670.8

• Appeals Court Shuts Down Bogus Private Enforcements of the ‘Yelp Law’–Moss v. GoDaddy
• Catching Up on the Bogus “Yelp Law” Litigation Campaign–Tao v. Uniqlo
• Amazon Must Defend “Yelp Law” Claim–Ramos v. Amazon
• Courts Are Rejecting Attempts to Weaponize Laws That Protect Consumer Reviews
• Businesses Cannot Contractually Ban “Abusive” Consumer Reviews
• California Tells Businesses: Stop Trying To Ban Consumer Reviews (Forbes Cross-Post)

The post Another Court Shuts the Door on “Yelp Law” Drive-By Lawsuits–Arterberry v. Peet’s appeared first on Technology & Marketing Law Blog.

The court accepts Harbor Freight’s claim that the “2024 Cookie Banner was displayed on each page on the Website until the user interacted with it, even if the user had previously visited the Website and interacted with the prior cookie banner.”

In 2025, Harbor Freight added an arbitration clause to the TCU. The TCU also contains a class action waiver.

The named plaintiff, Alba, says he visited the website at least once a year since 2020, including after the arbitration clause was added to the TCU. Alba allegedly selected the “Reject All Cookies” button.

What Terms Apply

The court accepts Harbor Freight’s evidence of its user interface:

Harbor Freight has satisfied its burden of proof and demonstrated that Alba was shown the 2024 Cookie Banner. It is undisputed that Alba visited the Website as recently as October 2025. Harbor Freight’s unrebutted evidence that the 2024 Cookie Banner was shown to all users following October 31, 2024, is therefore sufficient to demonstrate that Alba must have been shown the revised banner during his recent visits to the Website….

Alba did not submit a declaration or any other evidence denying that the Website displayed the 2024 Cookie Banner when he visited it in 2025

Alba pointed to an article that says that normally, in the EU, a website doesn’t redisplay the cookie banner to consumers who have already made a selection. The court says this article doesn’t raise any questions about the activities taking place in the US.

Formation

Turning to formation, the court characterizes the cookie banner as a “sign-in-wrap,” which takes us to the now-familiar Chabolla considerations.

Transaction Context. Favors Alba, because “simply browsing a website is insufficient to put the user on heightened notice to anticipate terms of service.”

Visual Design. The court says the offer notice was reasonably conspicuous:

First, the font size used for the advisory paragraph, hyperlinked Terms and Conditions, and buttons was the same. Second, the advisory paragraph displayed in black text against a white background, whereas the Terms and Conditions and Privacy Policy were each bolded, underlined, and in red font. Thus, the Terms and Conditions “stood out from the surrounding text to indicate it was clickable.” Third, the hyperlink to the Terms and Conditions was directly to the left of the three buttons and contained within the pop-up banner, meaning that a Website user could not click on any of the buttons without also seeing the Terms and Conditions displayed on their screen. Finally, there was nothing else cluttering the cookie banner, and the advisory paragraph expressly notified users that “[b]y clicking ‘Accept All Cookies,’ ‘Reject All Cookies,’ ‘Cookie Settings,’ or continuing to browse our website, you acknowledge and agree to our Terms and Conditions of Use.”

A few things:

• The cookie banner excerpt was presented in isolation, not in the context of the entire page. I find these kinds of excerpts unhelpful and maybe misleading. Is the offer conspicuous when looking at the whole page?
• Even in the excerpt, the font is small. It’s blurry in the screenshot I present above (taken from the court opinion).
• Although there isn’t a ton of text, the consumer would have to wade through the cookie discussions to see that the decision to proceed has implications far beyond cookies.

The court distinguishes Chabolla because, in that case, the offer was below the acceptance button such that someone might not look there (here, the text is to the left of the acceptance button). The court says it doesn’t matter that the offer disclosure was at the end of the paragraph block because the TCU links were “bolded, underlined, and in red font, meaning they stood out even without reading the entire paragraph.” Alba also complained that the links to the TCU and privacy policy were “mashed together,” but the court says consumers would recognize the space between them and, either way, still see the TCU reference.

Assent. Alba didn’t challenge assent separately from the disclosure visbility. But I’m stuck on this. Harbor Freight claimed that taking ANY of the following actions was assent: “clicking ‘Accept All Cookies,’ ‘Reject All Cookies,’ ‘Cookie Settings,’ or continuing to browse our website.” This seems extremely expansive. For example, forming the TCUs by continuing to browse is a browsewrap, not a sign-in-wrap. And if someone clicks “cookie settings,” presumably to investigate the website further, it seems unfair to presume they want to form the contract yet.

Also, I’m willing to bet that a majority of consumers presented with this interface would be shocked to learn that “reject all cookies” meant “accept all terms,” including an arbitration clause in the TCU. Yes, that is technically what the disclosures say, but it requires a lot of mental work to put all of this together. It also raises potentially interesting logic puzzles, like what if the cookie policies’ rules about declined cookies and the TCU terms are in conflict with each other? (Nothing in this case suggested that, but I’m raising the possibilities).

Implications

For another case upholding TOS formation via cookie banners, see LB v. LinkedIn.

While I think jamming Alba with the TCU terms when he declined cookies was a raw deal, I’ll note the plus side: Harbor Freight wisely used the engagement with the cookie banner for more than resolving the cookie policy. If you’re going to force users to click, go for the gusto and get them to agree to the TOS at the same time like Harbor Freight did.

The court orders Alba’s case to arbitration. However, another plaintiff in the case took all relevant actions before the arbitration clause was added to the TCU. That plaintiff’s claims are stayed until the arbitration resolves.

For more on cookie banners, you might be interested in Kate Klonick, Ban Cookie Banners: A Case Study in Tech Regulation. I don’t agree with all of her arguments, but I heartily endorse the article’s bottom line that the EU and other countries should reconsider cookie banner mandates (and, in my opinion, all other government-mandated interstitials that break the web’s “click-and-go” paradigm).

Case Citation: Alba v. Harbor Freight Tools USA, Inc., 2026 WL 2161637 (N.D. Cal. Juy 27, 2026)

The post When You Reject Cookies, You Might Be Agreeing to Arbitration–Alba v. Harbor Freight appeared first on Technology & Marketing Law Blog.

(a)(1) A contract or proposed contract for the sale or lease of consumer goods or services may not include a provision waiving the consumer’s right to make any statement regarding the seller or lessor or its employees or agents, or concerning the goods or services.

(a)(2) It shall be unlawful to threaten or to seek to enforce a provision made unlawful under this section, or to otherwise penalize a consumer for making any statement protected under this section.

These laws seek to foster consumer reviews by stopping businesses from contractually restricting such reviews. The same principle animates the Consumer Review Fairness Act.

While pro-consumer review laws are good policy, California dubiously attached a private right of action to 1670.8. In its wake, a small group of lawyers have initiated a spate of bogus lawsuits. The lawyers overread businesses’ TOSes, twisting ordinary TOS provisions into putative restrictions on consumer reviews. Enforcement then becomes basically point-and-click. The lawyers search for the targeted TOS provision and then sue the associated business without showing any harm to any consumer. At that point, it becomes a numbers game: file enough lawsuits to cash in from quick but undeserved settlements.

The California appeals court ruling rejects this litigation scheme. The court says 1670.8’s private right of action only applies to (a)(2), not (a)(1). This distinction requires the lawyers to have actual gagged consumers to proceed. Virtual drive-by litigation based solely on TOS language, without more, won’t cut it.

The panel reaches this conclusion because only (a)(2) contains the “it shall be unlawful” grammar that seemingly triggers penalties:

The differences between the two subdivisions permit a reasonable inference that the Legislature intended for subdivision (a)(1) to operate as a shield and for subdivision (a)(2) to provide the consumer with a sword when a seller threatens or takes action to enforce a waiver to stifle consumer speech.

On this point, the court sides with the Shofet case and ignores the Anderson case that reached the opposite conclusion.

The “shield” reference is confusing. A shield for whom, and against what? Later, the court says that TOS provisions that violate (a)(1) are unenforceable. However, that seems to render (a)(1) superfluous. If the legislature attaches a penalty to enforcing the TOS provision, doesn’t that penalty also simultaneously render the TOS provision unenforceable, at least implicitly?

This opinion isn’t precedential, so it is definitely not the final word on the matter. However, it’s also clear that this litigation genre is doomed, one way or another. The sooner, the better.

Even if (a)(1) doesn’t have a private right of action, businesses should still scrub their TOSes for any provisions that might be construed as restrictions on consumer reviews. Among other problems, enforcing those provisions could still trigger the private right of action.

Case Citation: Moss v. GoDaddy.com, Inc., 2026 WL 2122990 (Cal. App. Ct. July 23, 2026)

Selected Blog Posts Regarding 1670.8

• Catching Up on the Bogus “Yelp Law” Litigation Campaign–Tao v. Uniqlo
• Amazon Must Defend “Yelp Law” Claim–Ramos v. Amazon
• Courts Are Rejecting Attempts to Weaponize Laws That Protect Consumer Reviews
• Businesses Cannot Contractually Ban “Abusive” Consumer Reviews
• California Tells Businesses: Stop Trying To Ban Consumer Reviews (Forbes Cross-Post)

The post Appeals Court Shuts Down Bogus Private Enforcements of the ‘Yelp Law’–Moss v. GoDaddy appeared first on Technology & Marketing Law Blog.

This account has repeatedly posted false information that was reviewed by independent fact checkers or went against our Community Guidelines. Do you want to @mention this account?

There was a more prominent “cancel” button than the option to proceed, implicitly nudging users to cancel. F4F claims that none of its posts were false and Instagram didn’t rely on fact-checkers before displaying the interstitial warning.

The filings don’t appear to show the interstitial warning (why not?), but I found this example online:

F4F filed in Virginia state court. Instagram removed to federal court and then sought to transfer venue to California per its TOS. The federal district judge agrees.

F4F argued that Instagram’s TOS formation process was a browsewrap. I couldn’t find screenshots in the filings (why not?), but the court credits[FN] Instagram’s declaration that the signup process said “by tapping ‘Sign Up’ you agree to our Terms, Data Policy, and Cookies Policy.” The court says this is a “hybrid clickwrap,” not a “browsewrap.” I say it’s neither; it’s a standard sign-in-wrap, and we don’t have enough information to know if it’s properly formed without seeing screenshots.

[FN: The court says it credits Instagram’s declaration on a motion to transfer “given the declarant’s personal knowledge of the information described therein and given that Feds for Freedom’s allegations are consistent with the declaration.”]

F4F said it didn’t read the terms. (Indeed, literacy appears to be a major challenge in the anti-vax community). Quoting Dhruva, the court replies that “when a website provides clear and reasonably conspicuous notice that there are contract terms available by scrolling down or clicking a hyperlink, the user is on reasonable notice of those terms even if she never reads them.” As a result, F4F bears the consequences of its decision not to read the TOS. That’s enough to ship the case to California.

The court’s TOS formation ruling isn’t surprising, but the real action in this case will start when the court considers the legal implications of the interstitial warning. I have raised concerns before about the legal risks of fact-checking and other explanations. Unsurprisingly, the affected accounts really don’t appreciate being called out.

Case Citation: Feds for Freedom v. Meta Platforms, Inc. 2026 WL 2058962 (W.D. Va. July 16, 2026)

The post Court Upholds Instagram’s TOS–Feds for Freedom v. Meta appeared first on Technology & Marketing Law Blog.