0
A green speech bubble depicted on a dark background.

Chatbot Contracts: Enforcing TOS Agreements in Computer-Generated Conversations

[Although the rise of generative AI and large language models may seem novel, regulation of chatbots extends back years. To demonstrate, here is an article originally published by Metaverse Law’s founder and president, Lily Li, in the Spring 2017 Orange County ABTL Report.] Humanity has long imagined self-aware computers that can pilot our vehicles, purchase goods, and even sing songs for us, whether as the malevolent Hal in 2001: A Space Odyssey or the spunky Samantha in Her. Though fully sentient artificial intelligence is still science fiction (as far as we know), computer software has become “smart” enough to converse with us through text-based services like Facebook messenger, WhatsApp, or WeChat, or voice-operated services like Amazon’s Alexa or Apple’s Siri. As more e-commerce transactions are completed via these “chatbots” or “chatterbots” and away from browser-based websites, this begs the question: Will courts enforce the Terms of Service for chatbot contracts when the terms no longer appear on the same page – or even the same medium – as the transaction itself?
The Rise of Chatbots Consumer appetite for on-demand goods and services continues to grow, but at the same time, consumers are consolidating their online attention on a limited number of platforms. For social media and messenger services, this means Facebook. In 2016, 79% of online users were on Facebook, with 76% checking in daily. (Pew Research Center, Social Media Update 2016) Facebook’s Messenger had approximately 1 billion users, with WhatsApp and WeChat following closely behind. (Economist.com, “Bots, the next frontier”, April 9, 2016.) On the e-commerce and voice front, Amazon reigns supreme. Amazon accounted for 53 percent of all online sales growth in the United States in 2016, capitalizing on sales of its popular Echo and Echo Dot devices. (Slice Intelligence 2016). In light of these trends, e-retailers are increasingly leaving their own websites and apps, and developing custom, conversational chatbots to sell through these platforms. Internet Contracts 101: Mutual Assent and Notice The majority of e-commerce sales are regulated by online Terms of Service (“TOS”), also known as Terms and Conditions or Terms of Use (“TOU”). These internet contracts usually contain arbitration, forum, and venue provisions that govern the conduct of litigation. As a threshold matter, courts will only enforce these TOS if they find mutual assent to their provisions. In other words, consumers must be put on reasonable notice of online TOS, then provide objective outward manifestations of their agreement to the contract. Long v. Provide Commerce, Inc., 245 Cal.App.4th 855, 862 (2016). Courts have generally found mutual assent in “clickwrap” or “clickthrough” contracts, where the consumer clicks on an “I agree” or similar box or button, in tandem with a presentation of the TOS. In re Facebook Biometric Info. Privacy Litig., 185 F. Supp. 3d 1155, 1166 (N.D. Cal. 2016) (upholding California choice-of-law provision where plaintiffs clicked a box affirming they had read and agreed to the TOS, or where a separate plaintiff clicked a “Sign Up” button, with language immediately below stating that clicking the button constituted assent to the TOS). In contrast, courts are more hesitant to find mutual assent in situations where a link to the TOS appears on the online platform, but consumers do not affirmatively “click” to agree to those provisions. Compare Nguyen v. Barnes and Noble Inc., 763 F.3d 1171, 1178-1179 (9th Cir. 2014) (conspicuous hyperlink on every webpage not enough to demonstrate assent, where users were not prompted to take affirmative action) with Small Justice LLC v. Xcentric Ventures LLC, 99 F.Supp.3d 190, 197-98 (D. Mass 2015) (court distinguishes Nguyen and enforces TOS, where, in addition to hyperlink on each page, TOS were visible before the “continue” button on the final screen). For these “browsewrap” contracts, courts will analyze the conspicuousness of the TOS on the page, in context with the rest of the site or application, to determine whether “a reasonably prudent Internet consumer [is] on inquiry notice of the browsewrap agreement’s existence and contents.” Long, 245 Cal.App.4th at 123 (2016) (declining to impose TOS where hyperlink appeared in light green font on a page with light green background); see also Lee v. Intelius Inc., 737 F.3d 1254, 1257 (9th Cir. 2013) (TOS written in small, light grey print, next to a misleading “YES” button, caused customer confusion and was designed to deceive). Chatbots via Messenger: More of the Same Existing precedent on internet contracts is well equipped to handle text-based chatbots, and courts should be favorable to TOS presented conspicuously through such services. These chatbots have the ability to fashion contracts analogous to “clickwrap” or “clickthrough” agreements, by featuring conspicuous hyperlinks to online terms in a messenger window, and requiring consumers to affirmatively click to agree, type “YES” or “I Agree”, or words to that effect. The guided nature of text-based chatbots should in fact promote the enforceability of their TOS in court. Unlike a normal browser window, which may hide terms amidst other content, a messenger window limits consumer attention to a single step-by-step process. If done properly, consumers cannot proceed directly to an online shopping cart and bypass the terms completely. Instead, consumers can be required to outwardly manifest their assent to the TOS by typing or clicking for each transaction – a process favored by the courts. See Nguyen, 763 F.3d at 1177. Of course, by relying on third-party messenger platforms, chatbot services need to remain vigilant and ensure that TOS remain visible to consumers. In-messenger advertisements, large swathes of text, or strange fonts or colors imposed by a third-party platform may hide terms and render them unenforceable. For instance, in Specht v. Netscape Communications Corp., 306 F.3d 17, 23-30 (2d Cir. 2002), the court refused to enforce a software download TOS where consumers had the ability to click a “Download” button for free software, and consumers had to scroll down the page below the “Download” button to access a link to the TOS. Since the link was essentially subsumed under a “Download” splash screen, consumers had no inquiry notice of the TOS. Id. Similarly, consumers have all faced scenarios where third-party applications create splash screens above the content on websites, such as survey notices, advertisements, and videos, which may obscure small chatbot windows. Furthermore, chatbot services need to be aware of the TOS of third-party messenger platforms, which often require incorporation of specific licensing, privacy, and usage agreements within the chatbot terms. Here, clear access and delineation between these two competing sets of TOS is key, as the courts may refuse to enforce TOS where there is confusion as to which TOS apply, or refuse to enforce TOS that are only accessible through a series of pages and links. See Specht, 30 F.3d at 23-30; see also Cvent, Inc. v. Eventbrite, Inc. 739 F.Supp.2d 927 (E.D Va. 2010) (refusing to enforce TOS, where it was one of a series of links, and TOS page consisted of more links to other TOS). Voice Recognition – Hello World! For now, voice-based chatbots still rely on written TOS provided during online account sign up, which are subject to the same notice and assent requirements discussed above. Thus, when the TOS change for an underlying voice-activated device – or the third-party chatbot using such a device – consumers need to review, and generally provide affirmative assent, on a separate platform or application from the voice-activated service. Courts have often refused to enforce updated TOS, absent such express notice and affirmative assent from consumers, prior to ongoing use of an online service. See Douglas v. United States District Court, 495 F.3d 1062, 1066 (9th Cir. 2007) (court refuses to enforce arbitration agreement in revised TOS, holding that “[p]arties to a contract have no obligation to check the terms on a periodic basis to learn whether they have been changed by the other side”); Diverse Elements, Inc. v. Ecommerce, Inc., 5 F.Supp.3d 1378, 1381 (“[p]arties can…provide for modification in the contract and subsequently modify the contract with no new and independent consideration [Cite]…[t]his principle does not, however, allow parties to reserve the unfettered right to amend contracts without notice and at any unspecified time”); but see Klein v. Verizon Communications, Inc., 920 F.Supp.2d 670, 680-684 (E.D. Va. 2013) (upholding Verizon’s TOS where they provided that notice of revisions could be given by email, and new arbitration provisions were in fact provided by email). The ongoing requirement for consumers to access a separate device or application and “accept” new and revised TOS may become more onerous over time, however, as consumers move towards pure voice services through dozens (if not hundreds) of providers. Indeed, the whole impetus behind voice-based chatbots, as opposed to text-based solutions, is consumer desire for 24/7 on-demand services without the need to login or access physical devices. Consequently, courts will increasingly face scenarios where notices of new TOS or amended TOS are provided solely by voice. The chatbot will ask users to verbally agree to updated TOS, and then provide the terms separately by email or other text-based application. In these situations, it is not practicable to expect consumers to sit through an audio recitation of the TOS prior to purchase. Nor can TOS be provided concurrently with the verbal agreement, like “clickthrough” contracts, as there is no hyperlink, scroll-through, or pop-up window to view (absent VR/AR applications). Thus, in a pure voice paradigm, consumers will give – and will generally want to give – assent before they have an opportunity to review terms, if they review them at all. At first blush, this situation may appear to completely defeat the notice and mutual assent requirements for contract formation. Early case law surrounding “shrinkwrap” agreements, however, suggests that at least in certain jurisdictions, courts may still enforce these contracts. In ProCD, Inc. v. Zeidenberg, 86 F.3d 1447, 1451 (7th Cir. 1996), for example, Judge Easterbrook of the Seventh Circuit enforced the terms of a software license that was visible to plaintiff only after he had purchased a consumer package and downloaded the software. In enforcing this “shrinkwrap” agreement (named after the plastic cellophane around software boxes), the court noted that “[t]ransactions in which the exchange of money precedes the communication of detailed terms are common,” and quoted examples such as airline tickets, concert tickets, and standard warranties with consumer products. Id. at 1451. The court also recognized situations where “[a] customer may place an order by phone in response to a line item in a catalog or a review in a magazine…[t]here is no box; there is only a stream of electrons, a collection of information that includes data, an application program, instructions, many limitations…, and the terms of sale.” Id. at 1451-52. Judge Easterbrook reaffirmed this position in Hill v. Gateway 2000, Inc., 105 F.3d 1147, 1149 (7th Cir. 1997), by enforcing an arbitration agreement shipped in a computer box, where the consumer ordered the computer by phone and had the opportunity to return the computer in 30 days. The court noted, “[i]f the staff at the other end of the phone for direct-sales operations such as Gateway’s had to read the four-page statement of terms before taking the buyer’s credit card number, the droning voice would anesthetize rather than enlighten many potential buyers. Others would hang up in a rage over the waste of their time.” Id. The Seventh Circuit’s adoption of “order by phone now, see terms later” in ProCD and Hill seem like apt analogies for voice-based chatbots, where consumers verbally assent to an order, then view written terms at a later time. These cases, and their progeny, thus provide potential bases for enforcing TOS agreements for voice chatbots, so long as consumers have a reasonable opportunity to rescind the terms or refund the transaction later. See O’Quin v. Verizon Wireless,256 F.Supp.2d 512, 516 (M.D. La. 2003) (“[s]everal other federal and state courts have come to similar conclusions under similar factual scenarios [to Hill and ProCD], which were all premised on the consumer having the opportunity to return the product in order to avoid any term or condition that he found to be unacceptable”). Not all jurisdictions recognize the reasoning in Hill and ProCD, however. See Specht, 150 F.Supp.2d at 592; Klocek v. Gateway, Inc., 104 F.Supp.2d 1332, 1337 (D. Kan. 2000); Arizona Retail Sys., Inc. v. Software Link, Inc., 831 F.Supp. 759 (D.Ariz. 1993) (license agreement shipped with computer software not part of agreement). The Tenth Circuit, for instance, has stated outright that Kansas law rejects the reasoning of ProCD, holding that “a seller’s later-arriving written contract constitutes at most only a proposal to modify a preexisting oral contract, and […] a buyer’s assent to the proposed modification won’t be inferred simply from the buyer’s continuing the preexisting oral contract.” Howard v. Ferrellgas Partners, L.P., 748 F.3d 975, 982 (10th Cir. 2014). Consequently, chatbot providers must tread carefully before offering pure voice-based TOS agreements. Chatbots and Policy: Keeping it Simple Smart chatbots have immense potential to make consumers’ lives easier. Instead of navigating through endless webpages, dense text, and the inevitable clickbait ads, chatbots can provide an intuitive, conversational platform for e-commerce. Given the many consumer benefits of chatbot technology, everyone will benefit from clear case law governing the enforceability of chatbot contracts, and prior “clickthrough” and “shrinkwrap” doctrines provide useful guidance for the courts. *Disclaimer* This article is not legal advice or legal opinion, and the contents are intended for general informational purposes only. Circumstances may differ from situation to situation. All legal and other issues must be independently researched.
0
An image of the logo for LinkedIn, which is black text reading "Linked," followed by white text reading, "In," in a blue bow.

hiQ v. LinkedIn: User Agreements in the Age of Data Scraping

On November 4, 2022, LinkedIn announced a “significant win” for the platform and its members against “personal data scraping.” The win resulted from a 6-year legal battle that asked, in part, whether LinkedIn must allow hiQ Labs to scrape data from the public profiles of LinkedIn members. Last Friday, the U.S. District Court for the Northern District of California answered that question by ruling that LinkedIn’s User Agreement “unambiguously prohibits hiQ’s scraping and unauthorized use of the scraped data.” And as such, hiQ breached LinkedIn’s User Agreement “through its own scraping of LinkedIn’s site and using scraped data.”[1] An Overview of Data Scraping Data scraping is a technique by which a computer program extracts data from another program or source. The technique typically uses scraper bots, which send a request to a specific website and, when the site responds, the bots parse and extract specific data from the site in accordance with their creators’ wishes. Scraper bots can be built for a multitude of purposes, including:
  • Content scraping – pulling content from a site to replicate it elsewhere.
  • Price scraping – extracting prices from a competitor.
  • Contact scraping – compiling email, phone number, and other contact information.
In today’s economy, data is key, and data scraping is an efficient means of acquiring huge amounts of specific data. Yet, this court ruling signals that companies may need to be more cautious about how and where they use data scraping bots. hiQ’s Data Scraping Violates LinkedIn’s User Agreement Founded in 2012 as a “people analytics” company, hiQ Labs provides information to businesses about their workforces. To do this, hiQ extensively relied on using automated software to scrape data from LinkedIn’s public profiles. hiQ then aggregated, analyzed, and summarized that data to create two products, “Keeper” and “Skill Mapper,” which allowed businesses to improve their employee engagement and reduce costs associated with external talent acquisition. However, in 2017, LinkedIn sent a cease-and-desist letter threatening legal action against hiQ, arguing that LinkedIn’s User Agreement prohibits data scraping. Specifically, the User Agreement states: You agree that you will not:
  • Scrape or copy profiles and information of others through any means (including crawlers, browser plugins and add-ons, and any other technology or manual work);
. . .
  • Use manual or automated software, devices, scripts[,] robots, other means or processes to access, ‘scrape,’ ‘crawl’ or ‘spider’ the Services or any related data or information;
  • Use bots or other automated methods to access the Services, add or download contracts, send, or redirect messages.
Court records indicate that hiQ knew about this prohibition since 2015 yet continued scraping data from LinkedIn’s public profiles and even “attempted to reverse engineer LinkedIn’s systems . . . to avoid detection by simulating human site-access behaviors.” Based on these facts, LinkedIn sought a partial summary judgment finding hiQ liable for breach of contract. From hiQ Labs’ perspective, while the above User Agreement language may appear clear, language elsewhere in the User Agreement seemed to provide users and members with a right to scrape data from public profiles. Specifically, the User Agreement provides the following when delineating members’ rights and obligations: 2. Obligations . . . When you share information, others can see, copy and use that information. . . . 3.1 Your License to LinkedIn . . .

c. We will get your consent if we want to give others the right to publish your posts beyond the Service. However, other Members and/or Visitors may access and share your content and information, consistent with your settings and degree of connection with them.

hiQ argued that the User Agreement’s statements that “Visitors may access and share your content and information consistent with your settings” and that “[w]hen you share information, others can see, copy and use that information” are inconsistent with the prohibition of scraping data. And that, as a user and member of LinkedIn who agreed to the User Agreement, hiQ read this inconsistency to mean that hiQ had the right to scrape data from public profiles. Unfortunately for hiQ, this argument failed. The court concluded that informing users that their data may be copied and used does not contradict LinkedIn’s prohibition against scraping, crawling, or spidering. “The two concepts are not mutually exclusive – a warning to members that a third party may collect their public-facing data is not a blessing for third parties to do so through expressly prohibited means.” Thus, hiQ breached LinkedIn’s User Agreement, which “clear[ly]” prohibits data scraping, by scraping LinkedIn’s site and using that scraped data. LinkedIn May Lose Despite This Victory It is important to note that, although LinkedIn considered this a victory, the court only granted partial summary judgment in favor of LinkedIn on its breach of contract claim. hiQ raised numerous defenses to LinkedIn’s breach of contract claim, including waiver and estoppel, arguing that LinkedIn knew about hiQ’s data scraping as early as 2014 yet failed to act until the cease-and-desist letter in 2017. hiQ’s argument goes, in short, that because LinkedIn knew about hiQ’s data scraping but delayed in taking legal steps to prevent it, LinkedIn either waived its right to enforce the breach of contract claim or should be estopped because hiQ reasonably relied on LinkedIn’s acquiescence to the data scraping. The court concluded that there is at least a genuine dispute of material fact as to whether LinkedIn knew about hiQ’s data scraping as early as 2014, which – if sufficiently proven – could provide grounds for hiQ to raise the defenses of waiver and estoppel. These arguments remain unresolved, and it is not clear at this time whether hiQ and LinkedIn will continue battling in court – especially given that hiQ has gone dormant since 2019 – but we will continue monitoring for further developments. Further Privacy Concerns Lastly, this case brings to mind broader legal issues regarding publicly available personal information. Under the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), businesses must satisfy numerous obligations when processing personal information. However, the definition of “personal information” does not include “information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.” Similarly, under the EU’s General Data Protection Regulation (GDPR), the law’s prohibition against the processing of special data categories (e.g., race, ethnicity, religion, health, etc.) does not apply if the “processing relates to personal data which are manifestly made public by the data subject.” These exceptions are reminiscent of hiQ’s argument in this case: that LinkedIn’s User Agreement expressly said that “[v]isitors [of LinkedIn] may access and share your content and information consistent with your settings.” Meaning, the users themselves provided their information to LinkedIn and purposefully, via their settings choices, made their information available to the public. Putting aside that LinkedIn’s User Agreement prohibited data scraping, hiQ’s argument raises the question: was hiQ scraping publicly available personal information, as it is understood under the GDPR and CCPA / CPRA? And if so, does that mean that hiQ would not have to comply with some requirements imposed by applicable general data protection laws? The answer will likely depend on a fact-specific inquiry on the circumstances surrounding the user content, such as (i) which data protection law applies to the data subjects in question; (ii) whether privacy settings were readily apparent to users when they initially posted their profiles/content; and (iii) whether users took affirmative actions to publicly post their information. In the meantime, businesses should remain aware that scraping personal information, even publicly available information, requires proper planning and due diligence. Key Takeaways
  1. Data scraping remains a prevalent data collection practice, but individuals and companies may be liable for breach of contract claims stemming from data scraping practices in violation of a User Agreement.
  2. On the other hand, if a business wants to quash a company’s known data scraping practices that violate the User Agreement, waiting too long to take legal steps may result in the business forfeiting a breach of contract claim.
  3. Either way, this ruling indicates that companies must take User Agreements seriously, both their own (if they want to prevent data scraping) and those belonging to others (if they want to scrape data).
  4. Lastly, a question remains as to whether the data in this case was made publicly available, as the term is understood under US and EU data regulation laws.

[1] Note: The court also concluded that hiQ separately breached LinkedIn’s User Agreement by hiring independent contractors to create fake LinkedIn accounts to conduct “quality assurance” while logged into LinkedIn by “viewing and confirming hiQ customers’ employees’ identities manually.” LinkedIn’s User Agreement expressly prohibits creating false identities.