Sifuentes v. Dropbox, Inc. May Change How You Update Your Terms

For the past seven years, there are probably few folks on earth that have spent more time reading about clickwrap-centered litigation than my colleagues and I here at Ironclad. My first job, right out of law school, was monitoring public filings to help us build the very first Clickwrap Transaction Platform when we were back at PactSafe in 2015. Spending all that effort to stay up to date with these case decisions helps us stay ahead of the law in these areas, but let’s be honest – it’s not exactly riveting happy hour conversation. It’s not something I bring up at cocktail hour with friends.

But in the past few days, I’ve gotten more questions from customers and prospects – unprompted – about a brand new case decision out of the Northern District of California than ever before.

Sifuentes vs. Dropbox, Inc. completely changes how legal teams should be thinking about updating their terms of service (ToS) or other platform terms when it comes time for a change.

Email summaries may be out. Active consent is in.

Here’s what you should know.

Why’s everyone asking Ironclad about Sifuentes vs. Dropbox, Inc.?

Dropbox is in a dispute with a user that filed an action in November 2020, centering on an alleged data breach and compromise of his account in 2012. The plaintiff claims a wide array of harms – invasion of privacy, negligence, FCRA violations, breaches of multiple state laws, and intentional infliction of emotional distress. Rather than attempting to win this case on its merits, Dropbox moves to compel arbitration – a much cheaper, more private, more efficient way to handle this case rather than months to years of open litigation.

One problem: Dropbox first incorporated an arbitration clause in their terms in 2014, and this user signed up for his account and accepted terms in 2011. Dropbox sent the user an email with the notice of the change, and an opportunity to opt-out within 30 days if they’d like.

So, is an email notice enough to modify your past ToS or clickthrough agreement – without ever clicking to agree again? According to this court, it’s not.

Per this court, even the best email summary of terms changes isn’t enough to enforce your ToS change on its own. You now need clear, active consent to enforce a change to Terms of Service. In this case, that means Dropbox won’t be able to compel arbitration here – and will have to confront the dispute in open court.

Email doesn’t always cut it

Dropbox followed best practices for an email summary of changes. It still wasn’t enough.

Dropbox attempted to follow all best practices for one of these email updates – they summarized changes in the email, sent it out in advance of the change, provided a form to fill out if you wished to opt-out of arbitration, and even linked to a blog post further explaining the changes.

Eric Goldman, who’s run his Technology & Marketing Law blog for years on topics like this, wrote a great summary of the case & decision here. It’s a great overall summary and, well, one that is aptly titled – Dropbox’s TOS Amendment Fails (And If This Opinion Stands, Yours Will Too).

It’s worth noting that this case is hardly settled as rock-hard precedent. Goldman points out, and we agree, that this case is not in perfect alignment with past decisions out of the Ninth Circuit. Further, as a district court case in N.D. Cal., it’s not binding on any other court, either in or outside of California.

But it signals a willingness among judges to re-evaluate these ToS standards. And for now, it means relying on an email blast like this to update your terms can’t deliver the complete confidence of enforceability, especially around arbitration clauses like this one.

Here’s the solution

Having users re-accept new terms with a clickwrap when returning to your service is the fix.

Think of any other business contract: If a customer emailed you with a material, unilateral change to a contract you’d negotiated and signed years ago, would anyone assume that to be a true meeting of the minds?

We know traditional contracts require written and signed amendments, and this is perhaps a step in a more common-sense direction: To effect a change to a contract requires someone to actually accept that change. Transparency is starting to take precedence in the eyes of courts – and relying on an email notice that says you’re effecting a change to a contract may not work any longer.

Depending on which judge you’re working with and on what court you’re in, you could end up in the same dilemma that Dropbox now faces.

Good news: There’s a better way to solve ToS updates!

Require registered users to re-agree to any major, material change to your terms – whether that be when they return to your app or website or with some other similar mechanism.

We’ve been preaching this at every opportunity at Ironclad: It’s time to move away from a reliance on email notifications as the sole mechanism to make a ToS change. Inboxes are busy, read receipts are unreliable, and, now, some courts are holding an email blast summarizing the updates as completely unenforceable.

A better path is to move updates back into your app and present users with the opportunity to review and agree the next time they come to use your service, before they do anything else.

Not only will this provide courts with the “unambiguous manifestation of assent” that they are seeking, but the new acceptance will provide you with the individual evidence you need to prove that each user agreed to the new terms, as well as the confidence that all of the users engaging with your platform have agreed to the terms.

We’ve got pre-created developer documentation that shows how you can configure Ironclad Clickwrap into your log-in flow to ensure that every user is on the most up to date terms, at all times. Pair that with our first-of-its-kind Snapshots technology that automates capturing visual evidence, and it’s a simple and easy way to avoid a long, drawn-out dispute in open court that Dropbox now faces.

Ready to learn more? Just request more information and we’ll have a Clickwrap agreement expert reach out to you for a consultative session to help you understand what best practice updates you could put in place in light of the Dropbox decision

Note: Ironclad does not provide legal advice. You should consult your own legal counsel regarding the impact of this case or similar cases. This blog post provides educational best practices that can help inform software and technology decisions given our own analysis.