the Law, the Universe, and Everything 

Search

Concurring Opinions is a
general-interest legal blog
operated by Concurring
Opinions LLC, a Pennsylvania
Limited Liability Corporation.

lr_jkr9_15_08privacy.jpg

ad-logo5.jpg

Our Podcast

Subscribe to Law Talk

Law-Rev-Forum-2.jpg

law-rev-contents2.jpg

Law-Prof-Blog-Census.jpg

Categories

Accounting
Administrative Announcements
Administrative Law
Admiralty
Advertising
Agricultural Law
Anonymity
Antitrust
Architecture
Articles and Books
Bankruptcy
Behavioral Law and Economics
Bioethics
Blogging
Book Reviews
Bright Ideas
Capital Punishment
Civil Procedure
Civil Rights
Conferences
Constitutional Law
Consumer Protection Law
Contract Law & Beyond
Corporate Finance
Corporate Law
Criminal Law
Criminal Procedure
Culture
Current Events
Cyberlaw
DRM
Economic Analysis of Law
Education
Empirical Analysis of Law
Employment Law
Environmental Law
Estates and Trusts
Evidence Law
Family Law
Feminism and Gender
First Amendment
Food
Google & Search Engines
Health Law
History of Law
Humor
Immigration
Insurance Law
Intellectual Property
International & Comparative Law
Interviews
Jurisprudence
Law and Humanities
Law and Inequality
Law and Psychology
Law Practice
Law Professor Blogger Census
Law Rev (Boston College)
Law Rev (Boston University)
Law Rev (California)
Law Rev (Chicago)
Law Rev (Columbia)
Law Rev (Cornell)
Law Rev (Duke)
Law Rev (Emory)
Law Rev (Fordham)
Law Rev (Georgetown)
Law Rev (GW)
Law Rev (Harvard)
Law Rev (Illinois)
Law Rev (Indiana)
Law Rev (Iowa)
Law Rev (Michigan)
Law Rev (Minnesota)
Law Rev (Northwestern)
Law Rev (Notre Dame)
Law Rev (NYU)
Law Rev (Penn)
Law Rev (S Cal)
Law Rev (Stanford)
Law Rev (Texas)
Law Rev (UCLA)
Law Rev (Vanderbilt)
Law Rev (Virginia)
Law Rev (Wash U)
Law Rev (Wm & Mary)
Law Rev (Yale)
Law Rev Contents
Law Rev Forum
Law School
Law School (Hiring & Laterals)
Law School (Law Reviews)
Law School (Rankings)
Law School (Scholarship)
Law School (Teaching)
Law Student Discussions
Law Talk
Legal Ethics
Legal Theory
Media Law
Movies & Television
Philosophy of Social Science
Politics
Privacy
Privacy (Consumer Privacy)
Privacy (Electronic Surveillance)
Privacy (Gossip & Shaming)
Privacy (ID Theft)
Privacy (Law Enforcement)
Privacy (Medical)
Privacy (National Security)
Property Law
Race
Religion
Reparations
Science Fiction
Second Amendment
Securities
Securities Regulation
Social Network Websites
Sociology of Law
Supreme Court
Tax
Teaching
Technology
Tort Law
Web 2.0
Weird
Wiki
Wills, Trusts, and Estates

Archives

December 2008
November 2008
October 2008
September 2008
August 2008
July 2008
June 2008
May 2008
April 2008
March 2008
February 2008
January 2008
December 2007
November 2007
October 2007
September 2007
August 2007
July 2007
June 2007
May 2007
April 2007
March 2007
February 2007
January 2007
December 2006
November 2006
October 2006
September 2006
August 2006
July 2006
June 2006
May 2006
April 2006
March 2006
February 2006
January 2006
December 2005
November 2005
October 2005
August 2005
July 2005
June 2005
May 2005

 

« The Evolution of the Political Spot | Main | Inspiration and Realism in Denver »

August 27, 2008

How Not to Obtain Online Consent, or Why Panera Bread Owes Me Free Muffins

posted by Paul Ohm

panera-logo.PNG
When I need to edit an article, I will sometimes park myself at a booth at the local Panera Bread, sipping the decent coffee, snacking on the beautiful (notice I didn't say tasty) pastries, and using the free WiFi. Long ago, I noticed that Panera had made a stupid technological mistake that probably strips it of the right to manage its network lawfully.

Panera tries to extract consent from its users using what is known as a captive portal, the same method used by most hotel and airport WiFi network providers. When a Panera WiFi user first tries to connect to any website, Panera's computers redirect her instead to its own web page with a link to its terms of service (ToS). Only when the user clicks "I agree" may she start surfing.

Compared to some of the other methods Internet providers use for attempting to obtain consent, a captive portal deserves some praise. It is much more likely to be noticed and read than a ToS or privacy policy link buried on a home page (or, as the case may be, not even on the home page). It is better than the paper privacy policies my credit card companies send with their monthly bills, usually along with a half-dozen ads. Unlike either of these methods, a captive portal acts like a virtual stop sign--until you click "I agree," you can go no further. (Of course, calling even a captive portal meaningful consent seems to stretch things if the ToS offered are dozens of pages long.)

But if Panera ever tried to enforce its WiFi ToS--say it got caught monitoring user communications and had to defend against a wiretapping lawsuit or say it was sued for banning a user suspected of downloading porn in violation of the ToS--a court should probably hold that its ToS are unenforceable. Panera has made a simple web design mistake that introduces doubt about what terms are being agreed to by its users.

Like many sites, Panera displays the ToS within a text box. It probably does this to save screen real estate: with a text box, it can allow the user to scroll through a smallish-square rather than be faced with a dauntingly long web page. But carelessly, Panera made its text box EDITABLE! To see what I mean, compare the two text boxes below:


At the very least, Panera will have a hard time proving to a court that a particular customer didn't delete all of the ToS before clicking "I agree." But, there is a crazier possibility: Every time I am faced with Panera's editable ToS, I delete all of the text and replace it with a proposed contract of my own. Here are some of the contracts I have proposed:

  • "By allowing me to surf the web using your network, you agree to give me one free muffin every day for the rest of my life."
  • "By allowing me to surf the web using your network, you agree to name me CEO of Panera Bread for a day. I choose next Tuesday."
  • "By allowing me to surf the web using your network, you agree to change the name of your company to Pantera Bread, and the name of your 'Frontega Chicken' sandwich to 'Cowboys from Hell' Sandwich.'"

I know enough about the http protocol and cgi-bin to know that my modified ToSes probably get transmitted back to a Panera, er, Pantera web server. Are my contracts enforceable? Probably not. But my arguments for enforceability sound no less ridiculous than some of the arguments made by those seeking to enforce click-wrap and buried ToS "contracts".

Excuse me while I go try to claim a free muffin.

Posted by Paul Ohm at August 27, 2008 11:39 AM

Trackback Pings

TrackBack URL for this entry:
http://www.concurringopinions.com/movabletype/mt-tb.cgi/4079.

Comments

Wait a minute. Suppose I send you a contract written in pencil, foolishly, rather than ink. And suppose that contract comes with a bottle of beer, and says "by drinking the beer, you agree to the contract."

Can I erase the terms in the contract and write new ones, and still drink the beer?

I think Panera has no problem because they used editable text fields -- they made an offer and specified an action which signified an acceptance. The fact that you transmit a counter-offer at the same time as the acceptance, all the while gobbling up the consideration, seems meaningless.

Posted by: Paul Gowder at August 27, 2008 01:36 PM


Let's adjust it away from malice and see what happens:

What if a freak glitch in my landlord's printer results in the loss of a strategic "not". Now instead of

"pets are not allowed"

it reads

"pets are       allowed"

If my landlord doesn't notice this fact before we both sign at the bottom, can Mittens move in with me?

Posted by: John Armstrong at August 27, 2008 01:50 PM


John: From what I recall of contract law (and studying for the bar exam), Mittens can move in with you, but the parol evidence rules allows your landlord to produce certain extrinsic evidence to show that it was clearly a mistake.

Posted by: Matt at August 27, 2008 03:00 PM


Wait a minute. Suppose I send you a contract written in pencil, foolishly, rather than ink. And suppose that contract comes with a bottle of beer, and says "by drinking the beer, you agree to the contract."

Can I erase the terms in the contract and write new ones, and still drink the beer?

I think Panera has no problem because they used editable text fields -- they made an offer and specified an action which signified an acceptance. The fact that you transmit a counter-offer at the same time as the acceptance, all the while gobbling up the consideration, seems meaningless.

Posted by: Paul Gowder at August 27, 2008 03:37 PM


I think the difference is Paul that Panera's terms page is not just a mere notice, which arguably would create an implied contract, but rather seems to require a return manifestation of assent (i.e., the "I Agree" button). (If it is just a mere notice and all you're agreeing to is that you've received it, then editing is ineffective -- but I'm not sure the meaning of an "I Agree" button is just "I agree that I've received these terms.")

So if you edit it and then agree, you've at least made a counter-offer. But of course you know or should know that no one is on the other side reading the POST field as it comes back. Given the circumstances I don't think you can interpret Panera's performance as acceptance of the counter-offer. (Which is procedurally and likely substantively unconscionable, to boot.) So I doubt there's an enforceable contract at all.

Posted by: Bruce Boyden at August 27, 2008 03:39 PM


First, let me say, I really like this blog. Second, I'm not a lawyer, I have only had one course in BLAW in business school. However, I did pay close attention during the contract law part :)

Can't some offers come with options for the offeree? If that is the case, what's to say Panera isn't implying the option is there to amend the terms before agreeing? Perhaps that's part of the consideration they gave when making the offer.

I work as a programmer, and I can say that Panera could VERY EASILY check to see that the ToS they supplied (in either a read-only or alterable textbox) are the same when you send them back? Which, by the way, read-only textboxes are very easy to get around - as an expert on the matter, I would expect it to be checked server-side.

Love the post!

Posted by: Kenneth Younger at August 27, 2008 03:54 PM


John & Matt: If both parties are unaware of the mistake (in other words, if the lessor believes the instrument he is signing does not allow pets), then there has been no agreement and the K is void (see Sherwood v. Walker, the barren cow case).

If the lessor did know of the mistake, then the K is voidable only if the lessor knew or should have known that the omission was a mistake, or if inclusion of the mistake in the K would make it unconscionable (see Restatement Contracts 2d section 153).

Parol evidence would have nothing to do with it, as parol evidence is used to demonstrate a prior or contemporaneous oral agreement. It would come into play, for eample, if the landlord said "there's a typo regarding pets, but I just want to be clear that they are not allowed" and you said "OK". But in the case of a mistake, whether mutual or unilateral, there is no "meeting of the minds" and no K is formed, thus parole evidence is not needed because there is no K that you are seeking to have interpreted in light of the oral agreement.

As for Paul's original situation: Like the other Paul, I think the editing does not a contract make, because there is no action on the part of Panera that indicates acceptance. Ohm, of course, is trying to draw a parallel between that and buried ToS's, but I think the parallel is inapt. In a buried ToS case, the issue is whether the notice that a certain action, such as proceeding, constitutes acceptance of an offer to allow you to proceed. In Ohm's case, there is no action on the part of the counterofferee, and therefore no acceptance, and there is no issue of notice. Further, Ohm's purported K's all lack consideration, so this is all academic anyway (unless he can argue that "allowing me to surf your website" somehow constitutes consideration)

Posted by: Dave at August 27, 2008 03:55 PM


(Whoops, sorry for extreme computer glitch.)

Posted by: Paul Gowder at August 27, 2008 04:02 PM


Kenneth: You can't just say that the offer by Panera *could* be read as an offer of an option, rather it would actually have to be their intent to do so, or that they should have known that it would be interpreted as such. If Panera did not intend to have their offer be an option contract, then it cannot be one.... it does not matter that one "could" read their offer as constituting a blank-check option.

And even if we could interpret the offer by Panera as including an unlimited option, one would have to find consideration not just for the promises made by Panera and written in by Ohm, but also independent consideration supporting the option to write in whatever he wants. Even if that massive hurdle was overcome, you would have to also convince a court that Paul Ohm's agreement to proceed is adequate consideration for an option to get anything in the universe he can possibly describe in a text box.

Sometimes I find that many people, lawyers included, think that contract law is full of interpretive possibilities. The fact is, though, that it is fairly mechanical and precise. Having something that "almost" looks like a K is useless if there is a minor detail that prevents its formation.

Posted by: Dave at August 27, 2008 04:15 PM


I do not think you would need to stretch to find consideration here. Panera and many other restaurants provide WiFi in order to bring customers into the store and keep customers there so that they will buy more food and draw other customers.

Also, whether allowing you to use their WiFi after you change the terms of the offer constitutes Panera's acceptance of your counter-offer is an interesting issue and more than a mere academic exercise. No?

Posted by: Brooke at August 27, 2008 08:57 PM


Brooke: No. As far as consideration goes, why would your use of their wifi network be consideration for the promises that they make but that you wrote into the text box? Consideration must be bargained for, and you must limit the scope of your legal rights in exchange for the promises from the the other party. There is no commitment to purchase. Nor, really, is there a commitment to do anything on your part. Their offer of free wifi is certainly consideration for getting you into their store, but your use of the wifi once you are there is certainly not consideration for any promises on their part you might want to counteroffer to them.

As far as whether there is an acceptance: acceptance requires a manifestation of assent. There are narrow circmstances when assent can be signaled through silence (see R2d Contracts section 69), but this is certainly not one of them (and assent through silence at a minimum requires notice of their actually being an offer, which there is not here). I fail to see how not acknowledging a counteroffer constitutes an acceptance.

Consider this: if I stood on the street in front of a private shopping mall parking lot that had a sign on it that told me what the terms of my parking on the lot were, I certainly could not simply replace the sign with one that said that the owner of the parking lot, in consideration of me deigning to grace the lot with my car, promises to give me a million dollars. What is different in the current situation? We certainly would not say that the mall has a duty to monitor potential considerationless counteroffers and affirmatively reject them.

Posted by: Dave at August 27, 2008 10:49 PM


Matt, John, David

Re: mittens.

Well, first states vary on this.

First, David, with the barren cow case, you are confusing mistakes in communication with mistakes about the facts. The court’s belief in Sherwood was that both parties believed the cow was barren, and it turned out not to be. That’s different than someone just screwing up in writing down the contract. The difference is that in a mistaken communication, there is a meeting of minds, but they don’t express themselves properly. By comparison on the barren cow case, they weren’t even clear on what they were getting.

If there is a mutual mistake in the actual writing of the contract, proven by clear and convincing evidence, then the contract can be reformed to reflect the actual intent. The contract isn’t void.

But you are right to say that if there is a unilateral mistake, and the non-mistaken party knew or should have known about the mistake, then the party can then void the contract.

But failing those, the contract is enforceable.

Posted by: A.W. at August 28, 2008 09:24 AM


As a lawyer that works with ToS on a regular basis let me point out a couple things. First, the modified version of the contract is a rejection of the original terms and a counter-offer. So unless you can show acceptance of and assent to the new terms, your use would actually be unauthorized.

Acceptance of new terms would be pretty tough to show. I think that you'd have only one viable way to show acceptance: performance (they offered you the service FOLLOWING the new terms). But here performance is not going to get you the notice of the new terms--as necessary for assent.

So, the question is whether there could actually be notice and assent. I think that the only thing that would have "notice" of the new terms is the computer receiving the changed version of the agreement. I'm not aware of any case where a computer (or webserver) can be the agent for the purpose of assenting to a changes to the contract. That seems like a stretch.

So, in a brief post, I think that you successfully rejected the terms and your subsequent use was either unauthorized or governed by the terms of the first agreement (your continued use of the service despite rejection is performance evidencing acceptance and assent to the terms).

Posted by: mmm at August 28, 2008 10:26 AM


mmm, it's not clear from your post whether your work with ToS means that you're often drafting them for companies who propound them. If so, your argument is consistent with what one would expect your clients to assert.

I think nonetheless Kenneth raises an interesting factual point about how easy it is to automate checking the contents of the text-box. If it's a simple matter to do so, and if it's a simple matter for the website's server NOT to assent, by detecting a modification of the original ToS and then refusing to allow the user to use the site, your argument seems weaker. The problem is that, if Kenneth is right, the site owner would have means within its control to prevent the problem ever from arising. To nail a user for "unauthorized" use of the site when it's a simple technical fix for the site owner to prevent the use (and perhaps even negligent by the owner to provide an editable text box when it had no intention to read what the user might write therein) seems rather draconian, albeit consistent with the totalizing aspirations of many IP owners nowadays.

Posted by: A.J. Sutter at August 28, 2008 11:15 AM


Post a comment




Remember Me?

(you may use HTML tags for style)

Authors

Daniel J. Solove

Website
Understanding Privacy

Kaimipono Wenger

Website
SSRN Page

Dave Hoffman

Website
SSRN Page

Nate Oman

Website
SSRN Page

Frank Pasquale

Website
SSRN Page

Deven Desai

Website
SSRN Page

Michael O'Shea

Website
SSRN Page

Sarah Waldeck

Website
SSRN Page

Lawrence Cunningham

Website
SSRN Page

Danielle Citron

Website
SSRN Page

Jaya Ramji-Nogales

Website
SSRN Page


Guests

Paul Butler
Miriam Cherry
Mark Edwards
Brian Kalt
Jonathan Lipson
Scott Moss
Susan Scafidi






ad-logo3.jpg

blawg100_winner2.jpg

Previous Guests

Michael Abramowicz
Michelle Adams
Robert Ahdieh
Michelle Anderson
Laura Appleman
Francesca Bignami
Jeremy Blumenthal
Bruce Boyden
Donald Braman
Al Brophy
Neil H. Buchanan
Bill Burke-White
Scott Burris
Anupam Chander
Miriam Cherry
Jack Chin
Jennifer Collins
Allison Danner
Brannon Denning
Deven Desai
Mike Dimino
Christine Haight Farley
Kim Ferzan
Dan Filler
Amanda Frost
Timothy Glynn
Rachel Godsil
Eric Goldman
Craig Green
Jeffrey Harrison
Erica Hashimoto
Carissa Hessick
Laura Heymann
Christine Hurt
Darian Ibrahim
Dan Kahan
Sam Kamin
Heidi Kitrosser
Adam Kolber
Russell Korobkin
Anita S. Krishnakumar
Susan Kuo
Greg Lastowka
Sarah Lawsky
Erik Lillquist
Jeff Lipshaw
Joseph Liu
Solangel Maldonado
Jason Mazzone
William McGeveran
Salil Mehra
Carrie Menkel-Meadow
Max Minzner
Scott Moss
Eric Muller
Jaya Ramji-Nogales
Elizabeth Nowicki
Paul Ohm
Michael O'Shea
David Opderback
Kristen Osenga
Rafael Pardo
Marcy Peek
Eduardo Peñalver
Geoffrey Rapp
Neil RIchards
Lori Ringhand
Alice Ristroph
Paul Secunda
Jessica Silbey
Peter Smith
Charles Sullivan
Rick Swedloff
Steph Tai
Robert Tsai
Steve Vladeck
Sarah Waldeck
Melissa Waters
Alfred Yen
David Zaring
Timothy Zick
Howard Wasserman
Jonathan Zittrain

Blogroll

Above the Law
ACS Blog
Althouse
Balkinization
Becker-Posner Blog
Beltway Blogroll
BlackProf
BoingBoing
Chicago Law Faculty Blog
Conglomerate
Convictions
CrimLaw
Crime & Federalism
CrimProf Blog
Crooked Timber
Discourse.net
Dorf on Law
Election Law
Emergent Chaos
Feminist Law Profs
43(B)log
Freakonomics Blog
Freedom to Tinker
Google Blogoscoped
How Appealing
Ideoblog
Info/Law
Instapundit.com
JD2B.com
Juris Novus
Jurisdynamics
Law and Letters
Legal Profession Blog
Legal Theory Blog
Legal Times Blog
Leiter Reports
Brian Leiter's Law School Reports
Lessig Blog
Madisonian
Mirror of Justice
National Security Advisors
Opinio Juris
Point of Law
Political Theory Daily Review
PrawfsBlawg
ProfessorBainbridge.com
Property Prof
Red Tape Chronicles
The Right Coast
Schneier on Security
SCOTUSBlog
Security Dilemmas
Sentencing Law and Policy
Simple Justice
Sivacracy.net
The Situationist
Susan Crawford
TalkLeft
Talking Points Memo
TaxProf Blog
Tech & Marketing Law
Truth on the Market
Volokh Conspiracy
WorkPlace Prof Blog
WSJ Law Blog
Wonkette
The Yin Blog

Pajamas Media BlogRoll Member