In our digital age, clickwrap agreements − online agreements where a user has to click on a button or box to indicate agreement to certain terms before using online services − have become a ubiquitous method for obtaining a user’s assent to terms of service agreements. And courts across the country routinely enforce such agreements.

But what happens when a service provider amends the terms of the agreement after a user has clicked his assent? A recent Northern District of California decision, Sifuentes v. Dropbox, Inc., strongly suggests that service providers must take further steps to ensure the enforceability of the agreement as amended.

The district court in Sifuentes held that an agreement to arbitrate found within Dropbox’s terms of service agreement was unenforceable because Dropbox failed to demonstrate that a user had knowledge of the terms, including the agreement to arbitrate.

This case demonstrates what can happen when a provider fails to procure a further click, and how other courts may treat a similar absence of amended clickwrap in the future.

Sifuentes v. Dropbox

In 2011, the plaintiff David Angel Sifuentes III created a Dropbox account. To create his account and use Dropbox’s services, Sifuentes was required to affirmatively check a box next to hyperlinked text which stated “I agree to Dropbox Terms of Service,” and which linked to the text of the Dropbox’s 2011 terms of service agreement.

In 2014, several years after Sifuentes’s click-agreement, Dropbox amended its terms of service to include an arbitration provision arising from the use of Dropbox’s services. Dropbox emailed notices of the amendments to its users, including Sifuentes, but did not require users to acknowledge receipt of the amended terms.

In 2020, Sifuentes filed suit against Dropbox based on multiple causes of action, including claims for invasion of privacy by public disclosure of private facts, negligence, intentional infliction of emotional distress, and conversion and violations of the Fair Credit Reporting Act, Fair and Accurate Credit Transactions Act of 2003, and various state court claims.

Sifuentes alleged that his Dropbox account was compromised in a 2012 data breach, which put his personal information at risk, that Dropbox failed to inform him of the breach, that his personal information had been stolen and used by “hackers and cyber criminals,” and that, as a result of the data breach, his bank account had been made vulnerable.

Dropbox moved to compel arbitration. The district court had no issue holding that Dropbox’s typical clickwrap agreement was enforceable. Dropbox’s problem, however, was that the 2011 agreement did not contain the agreement to arbitrate it was seeking to enforce. Dropbox argued that a user’s continued use of its services following the email notice constituted assent to the amended terms.

The district court disagreed. Without a second clickwrap, which would have unambiguously demonstrated Sifuentes’s assent to the amended terms, the court ruled that Dropbox needed to demonstrate that Sifuentes had actual knowledge of the amended terms. But Dropbox had no evidence that Sifuentes had even opened the email containing the notice of the new terms. Without any such evidence, the court concluded, Sifuentes’s continued use of the platform could not constitute assent to the amended terms, including the agreement to arbitrate found within.

Conclusion

This decision is a timely reminder that a user’s assent to online agreements, and any amendments thereto, should be captured by clickwrap or a like mechanism that demonstrates that the user was placed on notice of the agreement and the user agreed to its terms before continuing to use the services. Relying on notice and continued use to demonstrate assent, as Dropbox did, is a precarious venture and may well lead, as in this case, to issues of enforceability down the road.