Hacker News Reader

Comment by hedora | Hacker News Reader

What happens if I add a “terms of business relationships addendum” to my facebook account (or homepage) that claims to override various clauses in all terms of service I’ve agreed to?

I’m serious. If the expectation is that I can be bothered to check for updates to 1000’s of terms of service every morning, why shouldn’t they be expected to hire someone to check personal homepages and social media accounts for such things?

“Last writer wins” in US contract law (roughly speaking, IANAL), and I’m reasonably sure I can establish that my addendum “happens after” company terms of service updates.

I’m happy to agree to binding arbitration, or flying to Washington to have a (corrupt?) judge or whatever process my complaint for a meagre $10,000 per hour (plus expenses) for the duration of the dispute.

Edit: payable up front, regardless of the outcome of the dispute.

View on HN

I mean, if you're serious, the answer is that Facebook didn't claim to have read your terms of service addendum, but you did say you read theirs, when you signed up.

I do agree with the sentiment though. IMO, if one party to a contract cannot have a reasonable expectation (!) that the contract was read by the other party, the contract should be considered invalid.

In some jurisdictions it already is.

German / European courts have ruled many times that consumer TOS clauses which are "surprising" and/or "unusual" (e.g. "hidden" feed or waivers) are not enforceable.

Courts around the world have made similar rulings. The technical term is "contact of adhesion" and while exact rules vary from country to country, most courts will at a minimum strike out clauses which are considered to be "unexpected" on the basis that the customer is unlikely to have actually read the contract. (This is why clauses such as exclusions of liability are traditionally in all caps or bold -- on the theory that this draws attention to them and may help to save them.)

Thanks for going into further and teaching me the correct term for this.

Except I didn't make that claim, I edited the DOM to make the button read, "I haven't read this agreement and waive no rights." Even if I did not, how do they expect to be able to prove that I did not?

I am well within my rights to modify the copy of a contract supplied to me, so it can hardly be said to be fraudulent to do such a thing. It isn't my fault that they don't want a copy of what I actually agreed to...

I really would like to see someone use this tactic in court. I am quite curious what the legal status of it would be and what the follow up arms race would look like if it a court sided with the user in such a case. I can imagine naive counters where they submit hashes of the agreed upon contents and suddenly typoes become legally binding when they refuse to accept such a modification.

How did you edit it? I haven't ever had Facebook, but if I understand correctly you are saying that you edited the terms of service and then successfully hit the "submit" button?

You can edit the content of any web site via the browser's dev tools. It's not hard. This only changes it locally, although it can have effects on poorly designed sites.

I have used this to buy tickets to an event for $1.

I once bought something with AJAX requests.

No, it wasn't unfair to the vendor. The vendor had an issue on a web site where the sales window closed, presumably to give the vendor time to process sales and print/mail tickets, but this was enforced front-end only. I was mid-check-out when the window closed with no warning.

There were plenty of tickets left. There was plenty of time left too (the vendor had switched from paper to digital tickets for COVID19, so...).

I think there was an exploitable security bug in there too, but I don't think anyone will exploit it. It's a little shop.

I was acquainted with the person who ran the event and website and let them know about the vulnerability and bought the tickets at the appropriate price after.

He was also storing passwords as plain text (they would email your password when you clicked "lost password?")... which is pretty troubling for a site that was also taking credit card payments.

I once registered to an event where the condition of attendance was to agree to have your personal data processed (that was many years before GDPR came and made such bullshit illegal). This was declared through a HTML form, with a bit of client-side JS that disabled the "Submit" button until you checked the "I agree to data processing" checkbox.

So of course I edited the page to let the submission through anyway, and the POST request had the appropriate consent boolean parameter to false instead of true. Since the registration completed successfully, they either ignored that parameter, or - what I was hoping would happen - their database had my row with a distinct FALSE on the consent column.

I sometimes wonder what would have happened if I decided to follow up on their data processing against my consent. Would I have a successful case? Or would they can me for working around their bit of client-side JS?

I believe that the outcome would be this:

You would go to court to sue Amazon. They would claim the suit should be dismissed because you had agreed to mandatory arbitration. You would claim you had NOT agreed to that clause, because you configured your browser to render different text before clicking on "I agree".

The court would then declare that since you had represented to Amazon that you were agreeing to it, they weren't responsible for what text you had changed in your browser, and the court would hold you to the contract that was supplied to you.

This isn't even a slight stretch. A stretch would be when Wells Fargo opened bank accounts for people without their permission -- then blocked a class action lawsuit arguing that the terms and conditions for the account (which the customers hadn't signed up for) required arbitration instead of class action lawsuits.[1]

[1] https://web.archive.org/web/20210428120303/https://www.nytim...

Maybe, but if that is the case, why even pretend to get consent? I have clearly not consented to waiving my rights in this scenario despite it maybe having no legal effect, if Amazon can simply dictate the terms of our business without any negotiation, why bother pretending? They can just post the terms and conditions somewhere on their site and then not bother forcing people to pretend to read them.

In this circumstance there is no contract. There is no meeting of the minds.

Generally they spam you with a letter or email or popup window or something when terms change. You make it sound kind of like keeping your software up to date, which is an interesting way to look at it.

Perhaps in the future legal aspects of life will be just another kind of software updating, with the govt rolling out emergency patches and big annual feature packs.

The very idea of a feature-complete style of government is both intriguing and outright frightening.

You have to have some plausible means of proving the company agreed to your terms. I don’t think a judge or jury would find that plausible. It’s just like how “silent” TOS changes are unenforceable.

A more colorable tactic is that you send a notice to their registered agent of addendums to the contract on your website, with possible future updates.

Certified mail to their registered agent is considered “received” by the corporation in most contexts.

I prefer to have the sheriff do the civil process to the managers (or managing partner) home address.... that way it freaks them out and gets the best response.

If you've actually done this, story time?

Received does not imply "accepted". I can also mail you an agreement in which you point your job payroll to my bank account, but you're not obligated to actually do it, right?

You're not obligated to do that.

The difference here may be that there's already a contract between a user and the company, so if they include something like "continuing to provide service to my account constitutes acceptance of these terms." in the updated contract, it might fly.

Or not. It could be that all the businesses doing that to their users are just BS'ing something unenforceable.

Reply on news.ycombinator.com