In Charting a New Course on Digital Consumer Protection at the Federal Trade Commission, former FTC Chair Lina Khan and her co-authors Samuel Levine and Stephanie Nguyen set out a fundamentally new regulatory framework for privacy that seeks to move beyond the “notice and consent” paradigm that has dominated privacy law for a generation. 1 Lina M. Khan, Samuel A.A. Levine & Stephanie T. Nguyen, Feature, Charting a New Course on Digital Consumer Protection at the Federal Trade Commission, 77 Stan. L. Rev. 1378-1382 (2025). They are right to do so. Privacy scholars are abandoning the paradigm in droves in the face of evidence that it does very little to protect privacy. 2 .See, e.g., Daniel J. Solove, Privacy Self-Management and the Consent Dilemma, 126 Harv. L. Rev. 1880 (2013); Ari Waldman, Privacy’s Rights Trap, 117 Nw. U. L. Rev. 88 (2022). Khan and her co-authors note that the hands-off approach that self-regulation with consumer consent was predicated on has caused significant problems, and they outline a characteristically ambitious regulatory vision for how the FTC can more effectively protect consumer privacy.
In this response, I suggest that while Khan and her co-authors are on the right track, even their ambitious vision may not be ambitious enough. The problem with the notice and consent paradigm isn’t limited to privacy law. It infects virtually all areas of modern consumer interaction with corporations. Contract law once reflected a bargain between parties who agreed to something. Unfortunately, those days are gone. At the same time that courts were abandoning regulatory oversight in favor of the freedom to contract with notice and consent, they were also stripping away the actual requirements of notice and consent. The result has been to replace the idea of contract as bargain with the very different idea that ordinary consumer conduct somehow connotes automatic agreement to terms of service placed somewhere on a website. Notice and consent hasn’t failed merely because people don’t care about their privacy, though that might be true. It has failed because we imposed the notice and consent paradigm while allowing companies to ensure that consumers actually got neither notice nor consent.
This failure has permeated all areas of law that affect consumers and employees, not just privacy. Antitrust is infected with fictional consent, as consumers and small businesses give away their right to bring class actions or indeed any lawsuits at all. And the tort and contract doctrines that once protected consumers against defective products have also fallen by the wayside, contracted away by the very act of doing business with a company in a document consumers never even see. 3 .See Mark A. Lemley, The Benefit of the Bargain, 2023 Wis. L. Rev. 237.
This is a problem bigger than the FTC. Courts that misinterpreted contract law got us into this situation, and ideally they are the ones who would get us out of it. But the FTC is the most proactive and innovative agency in government right now, and its powers extend beyond privacy, allowing it to regulate anticompetitive conduct, unfair competition, and deceptive practices. It can and should use that power to regulate corporate abuse of notice and consent not just in privacy cases, but in a range of competition and consumer protection cases as well.
This Essay proceeds in three Parts. In Part I I discuss the changes in modern contract law, something Khan and her co-authors advert to but don’t focus on. In Part II I explain the harms contract law imposes on consumers and others who deal with businesses. Finally, in Part III I offer some ideas for how to broaden the paradigm they offer beyond privacy law.
I. “Notice and Consent” Offers Neither Notice nor Consent
Khan and her co-authors rightly note that the FTC for decades followed on a privacy paradigm that relied on informed consumers and market competition to sort out privacy problems. As they explain, in the 1990s the FTC relied on self-regulation by companies. 4 .See id. at 1386-1390. At that time, few companies even had privacy policies, and the FTC felt that a rule of disclosure would give consumers the information they needed to make informed decisions. 5 See id. at 1388-1390.
It didn’t work. As Khan and her co-authors relate, and as numerous scholars have documented, the paradigm of notice and consent has failed in privacy law. 6 .Id. at 1380, 1389-1390 ; Chris Jay Hoofnagle, Privacy Self-Regulation: A Decade of Disappointment, in Consumer Protection in the Age of the ‘Information Economy’ 379, 382-84 (Jane K. Winn ed., 2006); Alicia Solow-Niederman, Information Privacy and the Inference Economy, 117 Nw. U. L. Rev. 357, 374, 376 (2022); Ari Ezra Waldman, Privacy’s Rights Trap, 117 Nw. U. L. Rev. Online 88, 90-91, 99-101 (2022). But see generally Daniel J. Solove, Data Is What Data Does: Regulating Based on Harm and Risk Instead of Sensitive Data, 118 Nw. U. L. Rev. 1081 (2024) (arguing for harm-based privacy regulation, a position Khan and co-authors reject). Characterizing privacy as a right that parties can contract away has simply meant that parties essentially always contract it away. Perhaps this is because they don’t care about privacy. But more likely it is because they don’t feel that they have a choice. As Khan and her co-authors note, “For most users, the ‘choice’ presented is whether to accept a company’s terms of service or forego the service altogether. . . . [This is a] false choice.” 7 Khan et al., supra note 1, at 1379-1380. Khan and her co-authors are right that consumers don’t have an effective choice when it comes to privacy. Even where privacy laws offer a nominal choice, companies circumvent it by making the sharing of data the easier option. 8 Lemley, Benefit, supra note __ (discussing how companies manipulate cookie tracking opt-outs under the GDPR). And in most cases the only “choice” a consumer has is to accept the terms or not use the service at all.
Further, even in the rare case that a consumer wants to make that choice, companies implement dark patterns, making it hard to cancel memberships, imposing switching fees, and designing sites to keep people there longer and to click on ads even when they don’t intend to. 9 .Id. at 1423-1425. For detailed discussion of the problem of dark patterns, see, for example, Mark A. Lemley, Free the Market: How We Can Save Capitalism from the Capitalists, 76 U.C. L.J. 115, 141-43 (2024) (explaining that many companies seek “to lock people into interactions and transactions” as “another way of making short-term revenue”); Attila Tomaschek, Tech, Canceling Online Subscriptions Is Confusing, Difficult and Absurd . . . by Design, CNET (Apr. 4, 2022, 1:55 AM PT), https://perma.cc/U3ZY-Z3Z7 (discussing how many companies employ similar “dark patterns” to make it difficult for customers to cancel services); David McCabe, U.S. Sues Adobe Over Hard-to-Cancel Subscriptions, N.Y. Times (June 17, 2024), https://perma.cc/YVA9-BKBA (describing a federal government suit challenging Adobe’s efforts to make it hard to cancel its subscription software services); Harry Brignull, Dark Patterns: Deception vs. Honesty in UI Design, Nw. Info. Design & Strategy (Nov. 1, 2011), https://perma.cc/645A-B2P3 (examining the ubiquity of dark patterns in website design); and Eric Ravenscraft, Security, How to Spot—and Avoid—Dark Patterns on the Web, Wired (July 29, 2020, 9:00 AM), https://perma.cc/YV9R-SR47 (warning that “[d]ark patterns are everywhere”). These “dark patterns “subvert, manipulate or impair user autonomy, decision-making or choice” and now pervade digital markets.” Amit Zac, Yu-Chun Huang, Amédée von Moltke, Christopher Decker & Ariel Ezrachi, Dark Patterns and Online Consumer Vulnerability, J. Behav. Pub. Pol’y – FirstView, Feb. 3, 2025, at 1, 1-3 (showing that even sophisticated users are affected by dark patterns); Woon Chee Koh & Yuan Zhi Seah, Unintended Consumption: The Effects of Four E-Commerce Dark Patterns, Cleaner & Responsible Consumption, Dec. 2023, at 1, 4 (showing that older users are particularly vulnerable to dark patterns); Gregory Day & Abbey Stemler, Are Dark Patterns Anticompetitive?, 72 Ala. L. Rev. 1, 14-16 (2020) (explaining how dark patterns “prey on cognition heuristics”); Gregory M. Dickinson, Privately Policing Dark Patterns, 57 Ga. L. Rev. 1633, 1642-49 (2023) (describing how dark patterns can be “so deceptive or coercive as to undermine the users’ free choices”); see also Midas Nouwens, Ilaria Liccardi, Michael Veale, David Karger & Lalana Kagal, Dark Patterns After the GDPR: Scraping Consent Pop-Ups and Demonstrating Their Influence 3 (Apr. 25-30, 2020) (unpublished manuscript at 9-10) (on file with the Association for Computing Machinery Conference on Human Factors in Computing), https://perma.cc/BH5S-HATD (describing the ways in which consent interface designs “make it more likely for users to provide consent” despite their desire for greater privacy).
But this isn’t a privacy problem—or at least, it isn’t just a privacy problem. It is a much larger problem. Consumer contract law is irretrievably broken. We have replaced a set of legal rules designed to allow people to agree with a means for large businesses to unilaterally impose terms and conditions on consumers and small businesses. Merchants now generally impose written terms on consumers on a “take it or leave it” basis. 10 .See, e.g., Mark A. Lemley, The Benefit of the Bargain, 2023 Wis. L. Rev. 237, 243-44 (lamenting contracts of adhesion, unequal bargaining power, and unequal legal advice); Nora K. Duncan, Adhesion Contracts: A Twentieth Century Problem for a Nineteenth Century Code, 34 La. L. Rev. 1081, 1081-82 (1974) (same); W. David Slawson, Standard Form Contracts and Democratic Control of Lawmaking Power, 84 Harv. L Rev. 529, 529-31 (1971) (same). For more general discussions of the problem of standard form contracts, see generally Friedrich Kessler, Contracts of Adhesion—Some Thoughts About Freedom of Contract, 43 Colum. L. Rev. 629 (1943); Todd D. Rakoff, Contracts of Adhesion: An Essay in Reconstruction, 96 Harv. L. Rev. 1173 (1983); and Robert A. Hillman & Jeffrey L. Rachlinski, Standard-Form Contracting in the Electronic Age, 77 N.Y.U. L. Rev. 429 (2002). Portions of this paragraph and the next one are adapted from The Benefit of the Bargain, supra. Because there is no lawyer on the other side, businesses have little incentive to write balanced terms rather than terms that unambiguously favor themselves. 11 .See Juliet M. Moringiello & William L. Reynolds, From Lord Coke to Internet Privacy: The Past, Present, and Future of the Law of Electronic Contracting, 72 Md. L. Rev. 452, 452 (2013); see also Shmuel I. Becher & Esther Unger-Aviram, The Law of Standard Form Contracts: Misguided Intuitions and Suggestions for Reconstruction, 8 DePaul Bus. & Com. L.J. 199, 213-15 (2010) (noting that there is some support for the claim that most consumers don’t even read form contracts in their entirety, much less consult an attorney). But see Florencia Marotta-Wurgler, Some Realities of Online Contracting, 19 Sup. Ct. Econ. Rev. 11, 23 (2011) (“[F]orum selection clauses, arbitration clauses, and class action waivers are not as pervasive or used strategically as some have feared.”); Florencia Marotta-Wurgler, Competition and the Quality of Standard Form Contracts: The Case of Software License Agreements, 5 J. Empirical Legal Studs. 447, 475 (2008) (finding that sellers with market power did not have significantly worse terms for consumers than other sellers). Marotta-Wurgler’s studies focused on shrinkwrap licenses, but there is reason to think companies may be more aggressive in setting terms online. See Wayne R. Barnes, Online Disinhibited Contracts, 51 Pepp. L. Rev. 267, 316-20 (2024).
The rise of one-sided contracts that apply to all our online interactions has put a rather significant burden on legal doctrines like unconscionability 12 .See Restatement (Second) of Contracts § 208 (Am. L. Inst. 1981) (“If a contract or term thereof is unconscionable at the time the contract is made a court may refuse to enforce the contract, or may enforce the remainder of the contract without the unconscionable term, or may so limit the application of any unconscionable term as to avoid any unconscionable result.”). and restrictions on limiting warranties to protect consumers from unfair surprise. 13 .E.g. Uniform Commercial Code §2-314 (creating an implied warranty of merchantability and requiring “conspicuous” language to disclaim it). And those doctrines have by general agreement proven not to be up to the task. 14 .See, e.g., Slawson, supra note 10, at 564 (“Even if normal procedures are employed, the substantive elements of unconscionability are too numerous and complex to be workable in large numbers of contracts cases.”); Lewis A. Kornhauser, Unconscionability in Standard Forms, 64 Calif. L. Rev. 1151, 1176-80 (1976) (noting the inadequacy of unconscionability to correct exploitation via form contracts in monopolistic structures). For a discussion of how to strengthen interoperability online, see, for example, Amit Elazari Bar On, Unconscionability 2.0 and the IP Boilerplate: A Revised Doctrine of Unconscionability for the Information Age, 34 Berkeley Tech. L.J. 567, 686-87, 700 (2019) (suggesting ideas like databases of unconscionable terms). Courts rarely apply the unconscionability doctrine, 15 Susan Landrum, Much Ado About Nothing?: What the Numbers Tell Us About How State Courts Apply the Unconscionability Doctrine to Arbitration Agreements, 97 Marq. L. Rev. 751, 775–91 (2014) (finding that half of the twenty states surveyed rarely entertain unconscionability, and in four others, “if the challenged contract provision is not related to arbitration, these courts rarely, if ever, find the challenged provision unconscionable”); cf. Babette E. Boliek, Upgrading Unconscionability: A Common Law Ally for a Digital World, 81 Md. L. Rev. 46, 87-88 & fig.2 (2021) (finding that unconscionability claims in the subset of 364 analyzed cases succeeded about 20% of the time when argued to judgment). For arguments that unconscionability can play a greater role, see generally Jacob Hale Russell, Unconscionability’s Greatly Exaggerated Death, 53 U.C. Davis L. Rev. 965 (2019) (noting the doctrine’s continued application in the consumer contracts). and doctrinal innovations have limited the reach of unconscionability and warranty doctrines. 16 For instance, on a motion to compel arbitration, courts deciding the unconscionability of a contract that includes an arbitration clause can consider only whether the arbitration clause itself is unconscionable; they can’t consider the context of the whole contract. E.g., Bischoff v. DirecTV, Inc., 180 F. Supp. 2d 1097, 1107 (C.D. Cal. 2002) (citing Gray v. Conesco, Inc., No. CV 00–322DOC, 2000 WL 1480273, at *3 (C.D. Cal. Sept. 29, 2000)). But see Penilla v. Westmont Corp., 3 Cal. App. 5th 205 (Ct. App. 2016) (finding that an arbitration provision with “more than one unlawful term” weighs against severing the term but enforcing the balance of the contract). Further, contracts are unconscionable only if they are both procedurally and substantively problematic. See Armendariz v. Found. Health Psychcare Servs. Inc., 6 P.3d 669, 690 (Cal. 2000) (stating that this is the dominant view among courts). Indeed, unconscionability may not apply at all to the formation of a contract as opposed to the terms contained in that contract. 17 Marin Storage & Trucking, Inc. v. Benco Contracting & Eng’g, Inc., 89 Cal. App. 4th 1042, 1049 (Ct. App. 2001) (“The doctrine of unconscionability is a defense to the enforcement of a contract or a term thereof. No such defense arises without a contract.” (citations omitted)); Curtis E.A. Karnow, The Internet and Contract Formation, 18 Berkeley Bus. L.J., no. 2, 2018, at 135, 151–52 (2021)”. Further, because consumers essentially never read standard form contracts, 18 .See Yannis Bakos, Florencia Marotta-Wurgler & David R. Trossen, Does Anyone Read the Fine Print? Consumer Attention to Standard-Form Contracts, 43 J. Legal Studs. 1, 3 (2014) (finding that 0.2% of 1,000 surveyed consumers look at an end user license agreement (EULA) for more than one second); Uri Y. Hacohen, Amit Elazari & Talia Schwartz-Maor, A Penny for Their Creations—Apprising Users’ Value of Copyrights in Their Social Media Content, 36 Berkeley Tech. L.J. 511, 558–64 (2021) (concluding that social media “users are unlikely to read the [terms of service] that govern their content”); Yifat Nahmias, Dalit Ken-Dror Feldman, Ganit Richter & Daphne R. Raban, Games of Terms, 45 Vt. L. Rev. 387, 406, 411 (2021) (highlighting that a Norwegian demonstration showed that the average smartphone had more than 250,000 words of privacy policies, and noting that “[t]he vast majority of internet users . . . hit[] ‘“I Agree’” rather than even glancing at these lengthy agreements”).” procedural doctrines that do things like put warranty disclaimers in large letters have turned out to be ineffective at protecting consumers. Nonetheless, courts regularly enforce such terms. 19 .See, e.g., ProCD, Inc. v. Zeidenberg, 86 F.3d 1447, 1449, 1452-53 (7th Cir. 1996); Peerless Wall & Window Coverings, Inc. v. Synchronics, Inc., 85 F. Supp. 2d 519, 527-29, 531 (W.D. Pa. 2000); M.A. Mortenson Co. v. Timberline Software Corp., 998 P.2d 305, 308-09, 313 (Wash. 2000); Davidson & Assocs. v. Jung, 422 F.3d 630, 639 (8th Cir. 2005); Bowers v. Baystate Techs., Inc., 320 F.3d 1317, 1325-26 (Fed. Cir. 2003); Adobe Sys. Inc. v. One Stop Micro, Inc., 84 F. Supp. 2d 1086, 1091-92 (N.D. Cal. 2000); Info. Handling Servs., Inc. v. LRP Publ’ns Inc., No. Civ.A. 00-1859, 2000 WL 1468535, at *1-2 (E.D. Pa. Sept. 20, 2000); Hill v. Gateway 2000, Inc., 105 F.3d 1147, 1149-50 (7th. Cir. 1997).
The internet has made the problem much worse because it has dramatically expanded the universe of interactions purportedly subject to standard form contracts. 20 .See David Hoffman, Defeating the Empire of Forms, 109 Va. L. Rev. 1367, 1371 (2023). Companies can and do put “terms of use” on their websites and treat the act of visiting the website as agreement to those terms. In the last fifteen years, enforcement of this mutant form of contract has become widespread—even in consumer cases 21 See, e.g., Nevarez v. Forty Niners Football Co., No. 16-CV-07013, 2017 WL 3492110, at *8 (N.D. Cal. Aug. 15, 2017) (enforcing a browsewrap contract that “prominently informed [users] on at least two occasions prior to [the purchase]” since they clicked “Accept and Continue” or “Sign In,” and then clicked “Submit Order,” thereby agreeing to the terms of service, “which were always hyperlinked and available for review” (quoting Graf v. Match.com, LLC, No. CV-15-3911, 2015 WL 4263957, at *4 (C.D. Cal. July 10, 2015))); Emmanuel v. Handy Techs., Inc., 992 F.3d 1, 3, 10 (1st Cir. 2021) (finding that a checked box saying “I agree to Handy’s Terms of Use” with a hyperlink to those terms created a contract); HomeAdvisor, Inc. v. Waddell, No. 05-19-00669-CV, 2020 WL 2988565, at *2, 5 (Tex. Ct. App. June 4, 2020) (concluding that clicking a button near a statement of the company’s services bound a consumer to the company’s terms and conditions). For useful surveys of recent cases, see Nancy S. Kim, Wrap Contracts: Foundations and Ramifications 35-52, 70-81 (2013); and Nancy S. Kim, Developments in Digital “Wrap” Contracts, 77 Bus. Law. 275, 275-85 (2022). —as more and more of our daily life transitions online. While in theory courts look for assent in these contracts by favoring “clickwrap” over “browsewrap” terms, 22 For a discussion of clickwrap contracts (where a user clicks on a button to use a service) and browsewrap contracts (where simply accessing the site is deemed to be agreement to terms and conditions placed somewhere on the site), see Mark A. Lemley, Terms of Use, 91 Minn. L. Rev. 459, 461-63, 469-70 (2006). Courts have more recently been distinguishing a third category, the so-called “sign-in wrap,” in which a party does not click on agreements but clicks to sign in to a site and is presented with a link to terms and a statement that logging in constitutes agreement to those terms. See Eric Goldman, Court Upholds a Browsewra (Because It Was Really a Sign-in Wrap), https://blog.ericgoldman.org/archives/2025/05/court-upholds-a-browsewrap-because-it-was-really-a-sign-in-wrap-hoar-v-hotmart.htm. at least requiring consumers to make a “take it or leave it” choice to adhere to terms they usually aren’t even presented with, even that fictional assent is not always required:
Courts in many jurisdictions will enforce terms of service even if there is literally no way for a consumer to see them, much less agree to them. 23 .See, e.g., Sw. Airlines Co. v. Kiwi.com, Inc., No. 21-cv-00098, 2021 WL 4476799, at *3-4 (N.D. Tex. Sept. 30, 2021) (finding an enforceable contract in part because “[t]he Terms are hyperlinked at the bottom of each page of Southwest’s website with a statement that use of the website constitutes acceptance of the Terms”). This sort of Catch-22 provision—by coming to the site, a user agrees to terms that they can’t possibly read without coming to the site—is surprisingly common in browsewraps. See, e.g., Terms of Use, IBM (Nov. 20, 2020), https://perma.cc/HW7Z-52S5 [hereinafter IBM Terms] (“By accessing, or using this Web site, you acknowledge that you have read, understand, and agree, to be bound by these terms . . . . If you do not agree to these terms, please do not use this Web site.”); Terms of Use, XE, https://perma.cc/HTF2-H47M (last updated Sept. 1, 2012) (“By accessing and using [the Web Site] . . . you are acknowledging that you have read and agree to be bound by these Terms of Use . . . . If you do not acknowledge and agree . . . you may not access or use [the Web Site].”).
Courts sometimes enforce contracts “agreed to” by robots that have no power to do any such thing. 24 .See, e.g., Cairo, Inc. v. Crossmedia Servs., Inc., No. C 04-04825, 2005 WL 756610, at *2-5 (N.D. Cal. Apr. 1, 2005) (enforcing an “agreement” by a robot to litigate exclusively in multiple different jurisdictions simultaneously). It is possible that future artificial intelligence could be bound by smart contracts using the blockchain, but we are not yet at that point. See Steve Omohundro, Cryptocurrencies, Smart Contracts, and Artificial Intelligence, AI Matters, Dec. 2014, at 19, 19-20. For a discussion of the contradictory terms in enforceable browsewraps, see Lemley, note 22 above, at 478-80.
Even visiting the terms of use page itself to see whether you want to agree to those terms has been deemed agreement to the terms. 25 See, e.g., Foster v. Walmart, Inc., 15 F.4th 860, 862-65 (8th Cir. 2021) (finding a triable question of fact on whether purchasers of gift cards were bound to an arbitration clause not disclosed on the gift cards themselves, but contained in browsewrap on a website referenced on the back of the gift cards). .
Parties sometimes write terms of use that include an advance agreement to unspecified future changes in terms. 26 Most sites provide that their terms will change periodically and that the user is automatically bound to those changed terms. They generally suggest that the user “““““regularly check” for changes to the terms and conditions. See, e.g., ““IBM Terms, supra note 23 (“IBM may, without notice to you, at any time, revise these Terms of Use . . . .”); Email from YouTube to YouTube Users (Nov. 27, 2021, 6:27 AM) (on file with author) (“On January 5, 2022, we’re updating our Terms of Service . . . . By continuing to use YouTube after this date, you are agreeing to the updated Terms.”); see also Acceptance of Terms of Use Agreement Sample Clauses, Law Insider, https://perma.cc/F9CA-FW6X (archived May 15, 2025) (to locate, scroll to the fifth “Acceptance of Terms of Use Agreement” sample) (“We may make changes to this Agreement and to the Service from time to time. . . . The most recent version of this Agreement will be posted on the Service under Settings . . . , and you should regularly check for the most recent version.”). For discussion of the growth of “terms later” contracting, see John E. Murray, Jr., The Dubious Status of the Rolling Contract Formation Theory, 50 Duq. L. Rev. 35, 37-57 (2012); and Eric A. Posner, Essay, ProCD v. Zeidenberg and Cognitive Overload in Contractual Bargaining, 77 U. Chi. L. Rev. 1181, 1181-87, 1194 (2010). While courts won’t enforce pre-agreement to such changes, 27 .See, e.g., Int’l Mkts. Live, Inc. v. Thayer, No. 22-cv-00077, 2022 WL 4290310, at *5-6 (D. Nev. Sept. 16, 2022). they sometimes hold that repeatedly visiting a website binds the customer not just to the initial terms posted there but to any changed terms that may thereafter appear. 28 .See, e.g., Register.com, Inc. v. Verio, Inc., 356 F.3d 393, 401-04 (2d Cir. 2004) (explaining that by “daily submitting numerous queries, each of which resulted in its receiving notice of the terms Register exacted” while knowing “what terms Register demanded,” the district court was within its discretion to find that Register was likely to prevail on its claim that Verio assented to Register’s contract terms). But see Stover v. Experian Holdings, Inc., 978 F.3d 1082, 1086 (9th Cir. 2020) (applying the original rather than the later terms, though doing so in a way that benefited the drafter of the terms).
And if you have already given your data to a company under a particular privacy policy, they may (and frequently do) unilaterally change what they do with the data they already have about you. 29 Jessica L. Roberts & Jim Hawkins, When Health Tech Companies Change Their Terms of Service, 367 Sci. 745, 745-46 (2020) (““A recent study of the privacy policies of 90 consumer genetics companies revealed that all of the companies surveyed included unilateral amendment provisions, whereas only a handful promised to inform individual users” [of changes to data policies].”“); see also Leah R. Fowler, Jim Hawkins & Jessica L. Roberts, Uncertain Terms, 97 Notre Dame L. Rev. 1, 44-45 (2021) (discussing health privacy).
The result would make Darth Vader proud. 30 Vader on Contracts:Darth Vader: “Calrissian, take the princess and the Wookie to my ship.”Lando Calrissian: “You said they’d be left in the city under my supervision.”Darth Vader: “I’m altering the deal. Pray I don’t alter it further.”See The Empire Strikes Back (Lucasfilm Ltd. 1980).
Further, the move to enforce online terms of use has meant that companies and websites increasingly impose contract terms on third parties who would never before have found themselves in a contractual relationship. One of the most important limits the requirement of assent has traditionally imposed on the reach of contract law is the doctrine of privity. 31 .See 13 Williston on Contracts § 37:1 (4th ed. 1993) (“Under the traditional common-law rule, only parties in privity of contract could sue on the contract: ‘It is essential to the maintenance of an action on any contract that there should subsist a privity between plaintiff and defendant in respect of the matter sued on.’”)” (footnote omitted). Because contract law applied only to voluntary transactions, it bound only the transacting parties: Third parties couldn’t be bound to someone else’s contract. And while the law occasionally recognizes third party beneficiaries, the circumstances in which it does so are limited. 32 .See id. Modern end user license agreements (EULAs), by contrast, purport to run with the product or even service in question, binding any end user who comes in contact with the product. 33 .See Thomas M.S. Hemnes, Restraints on Alienation, Equitable Servitudes, and the Feudal Nature of Computer Software Licensing, 71 Denv. U. L. Rev. 577, 585 (1994); Molly Shaffer Van Houweling, Cultural Environmentalism and the Constructed Commons, 70 L. & Contemp. Probs. 23, 30–33 (2007); Molly Shaffer Van Houweling, The New Servitudes, 96 Geo. L.J. 885, 925-26 (2008); Danielle D’Onfro, Contract-Wrapped Property, 137 Harv. L. Rev. 1058, 1073-74 (2024). The result is that not only are buyers of products potentially bound to terms they can’t see or assent to, but those terms follow the product, purporting to bind purchasers of used goods after resale or even those who pick up the product to use it with the permission of the buyer. This wasn’t historically true; the original seller of a product had no ability to control what people did with it after it was first sold. 34 .See, e.g., Kirtsaeng v. John Wiley & Sons, 568 U.S. 519 (2013) (“The “first sale” doctrine is a common-law doctrine with an impeccable historic pedigree. In the early 17th century Lord Coke explained the common law’s refusal to permit restraints on the alienation of chattels. Referring to Littleton, who wrote in the 15th century, Gray, Two Contributions to Coke Studies, 72 U. Chi. L. Rev. 1127, 1135 (2005), Lord Coke wrote: “. . . A law that permits a copyright holder to control the resale or other disposition of a chattel once sold is simi- larly “against Trade and Traffi[c], and bargaining and contracting.” 1 E. Coke, Institutes of the Laws of England §360, p. 223 (1628).”). This doctrinal innovation takes contract law out of the realm of private deals and effectively turns it into private legislation.
II. Contracts Without Competition
The problem of enforcing contracts that are hard (or impossible) to find and harder to read is compounded by the absence of competition over contract terms. “Take it or leave it” isn’t a great option, but it generally is an option. The customer who doesn’t like the deal can usually walk away from it and, at least in theory, find a competitor with a better deal. 35 .See Shmuel I. Becher & Esther Unger-Aviram, The Law of Standard Form Contracts: Misguided Intuitions and Suggestions for Reconstruction, 8 DePaul Bus. & Com. L.J. 199, 201 (2010) (pointing out that consumers face genuine choice in some instances, but still typically assent to these form contracts). It was this idea—not just consumer awareness but consumer choice—that drove the privacy consensus around notice and consent.
Increasingly, however, there is no alternative. Standard form contracts become more problematic if “leave it” is not a practical option. 36 .See George A. Nation III, Contracting for Healthcare: Price Terms in Hospital Admission Agreements, 124 Dick. L. Rev. 91, 122–25 (2019) (noting that standard form terms apply to patients admitted to emergency care in hospitals). I don’t have any choice as to the terms of the contract with my water company, because I need water and there is only one company that is permitted to sell it to me. Other companies hold monopoly power without a government franchise—many people still don’t have effective choice over, say, where they get internet service from. 37 There are two broadband wires running into some homes but by no means all, and many homes have no broadband access at all. See Christopher Mitchell & Katie Kienbaum, Report: Most Americans Have No Real Choice in Internet Providers, Inst. for Loc. Self-Reliance (Aug. 12, 2020), https://ilsr.org/report-most-americans-have-no-real-choice-in-internet-providers/ [https://perma.cc/W2Q8-5V8Y]. Employment contracts, too, are almost never presented in circumstances that give the employee an effective choice. 38 For a discussion in the employment context, see Orly Lobel, Boilerplate Collusion: Clause Aggregation, Antitrust Law & Contract Governance, 106 Minn. L. Rev. 877, 878–80 (2022). And antitrust enforcement has languished in the same period courts started enforcing online terms of use. 39 .See Khan et al., supra note 1, at 1394. That has meant that markets are much more concentrated than they were fifty years ago. 40 .See, e.g., Lemley, Free the Market, supra note 9, at 120. As a practical matter there may not be a competitor down the street to whom a disgruntled customer can turn.
“Take it or leave it” may also not be a practical option if the industry has coalesced around similar contract terms. 41 .See Eric Goldman, The Crisis of Online Contracts (As Told in 10 Memes), Notre Dame J. on Emerging Techs., https://ndlsjet.com/the-crisis-of-online-contracts-as-told-in-10-memes/; Thomas D. Haley, Illusory Privacy, 98 Ind. L.J. 75, 89-90 (2022) (noting that the market power of tech platforms means that any appearance of choice of policies is illusory). I have two basic choices of smartphone software—iOS and Android—but that doesn’t mean Apple and Google can or will compete to offer me better contract terms. And if they don’t, my assent to the contracts they hand me at the store doesn’t reflect any real agreement. 42 .See Haley, supra note 41, at 117. Standardization around similar terms is common across many industries. 43 .See Uri Y. Hacohen, Amit Elazari & Talia Schwartz-Maor, A Penny for Their Creations—Apprising Users’ Value of Copyrights in Their Social Media Content, 36 Berkeley Tech. L.J. 511, 539-41 (2021) (studying terms governing user-generated content); Mark R. Patterson, “Standardization of Standard-Form Contracts: Competition and Contract Implications,” 52 Wm. & Mary L. Rev. 327, 331 (2010).
These factors compound each other. The easier it is to enforce terms without making them effectively available to consumers, the less likely consumers will change their purchasing decisions because of them. The less likely consumers are to pay attention to terms and conditions, the less likely companies are to compete on them. And the fewer competitors there are, the less likely it is that either consumers or competitors will see competing on something like a privacy policy as a viable option.
Courts should be more sympathetic to the “no effective choice” argument where markets are not competitive or where the industry all uses standard terms. Consumers in those circumstances are entering into a transaction, but only because they have no choice. That’s not what contract law has in mind when it speaks of assent. 44 .See James Grimmelmann, Spyware vs. Spyware: Software Conflicts and User Autonomy, 16 Ohio St. Tech. L.J. 25, 47 (2020) (“Whatever this is, it is not actual consent.”); Hoffman, supra note 20, at 1369; Lemley, Benefit of the Bargain, supra note 10, at 247-48; Neil Richards & Woodrow Hartzog, The Pathologies of Digital Consent, 96 Wash. U. L. Rev. 1461, 1486-88 (2019).
The fundamental problem with relying on notice and consent for privacy, then, is that in practice users have neither notice nor the opportunity to consent. Khan et al. are therefore right to suggest that the FTC should move beyond the broken notice and consent paradigm for privacy law.
But the consequences go well beyond privacy law. The fact that consumers (and anyone else who interacts with a website, for that matter) are deemed bound to virtually any term the site desires enables all sorts of problematic provisions. It means companies use arbitration clauses that prevent injured plaintiffs from suing, and often ban class actions or other mechanisms for collective enforcement of antitrust and consumer protection laws. 45 For a detailed discussion of these provisions and their problems, see, e.g., Mark A. Lemley & Christopher R. Leslie, Antitrust Arbitration and Merger Approval, 110 Nw. U. L. Rev. 1, 13-41 (2015). The Supreme Court approved this practice in American Express Co. v. Italian Colors, 570 U.S. 228, 239 (2013). It means consumers regularly give up the normal warranty rights the law would otherwise provide, and employees may give up their rights under labor and employment law or be bound by restrictive noncompetes or NDAs without even knowing it. 46 .See U.C.C. § 2-316 (Am. L. Inst. & Unif. L. Comm’n 2022); Robert A. Hillman & Ibrahim Barakat, Warranties and Disclaimers in the Electronic Age, 11 Yale J.L. & Tech. 1, 22-28 (2009); Viking River Cruises v. Moriana, 142 S.Ct. 1906, 1925 (2022) (barring enforcement of California labor laws). It creates practical nonenforcement zones in which companies are free to violate tort laws with impunity, make it hard or impossible to cancel services or get refunds, and even take deliberate action to brick our devices without being called to account. 47 .See Grimmelmann, supra note 44, at 26-34; Rebecca Crootof, The Internet of Torts: Expanding Civil Liability Standards to Address Corporate Remote Interference, 69 Duke L.J. 583, 612-18 (2019); Chris Jay Hoofnagle, Aniket Kesari & Aaron Perzanowski, The Tethered Economy, 87 Geo. Wash. L. Rev. 783, 795-96 (2019).
III. A Broader Agenda for Consumer Protection
What is notable about the problems I identify in Part II is that they mostly fit quite well within the scope of the FTC’s other, non-privacy authority. Antitrust is the most obvious because it is at the heart of the FTC’s remit. 48 See 15 U.S.C. § 45(a). Both the nature of the no-choice problem (which, as I noted above, is exacerbated by market concentration) and some of the specific consequences of that problem (arbitration clauses that ban antitrust suits, treble damages, or class actions) are antitrust problems. But other consequences fit easily within the FTC’s jurisdiction to control unfair or deceptive business practices. The FTC has already moved to ban noncompetes. 49 .See Non-Compete Clause Rule, 89 Fed. Reg. 38342 (May 7, 2024) (to be codified at 16 C.F.R. pts. 910, 912). Some courts have enjoined that rule, while others have upheld it. Compare Ryan v. FTC, 746 F. Supp. 3d 369 (N.D. Tex. 2024) (enjoining rule) with ATS Tree Servs. v. FTC, 2024 WL 3511630 (E.D. Pa. July 23, 2024) (upholding rule). It remains to be seen whether the Trump administration will withdraw the rule. At this writing, the FTC had asked for a stay in the pending appeals to give it time to decide whether to continue with the rule. But whether or not it does, regulating noncompetes is something that should fall within the scope of the FTC’s jurisdiction. It has taken a number of actions to protect consumers against junk fees, cancellation mazes, dark patterns, and other deceitful corporate behavior, which fall well within its authority to regulate deceptive acts and practices. 50 For a summary of these actions, see Lemley, Free the Market, supra note 9, at 155-57; Khan et al., supra note 1, at 1426-1430. And many of the other consequences, such as restrictions on warranties and limitations on tort liability, fall within the ambit of the “unfair” prong of the FTC’s consumer protection authority as Khan and her co-authors describe it. 51 .See Khan et al., supra note 1, at 1398.
Thus, while I am in agreement with Khan and her co-authors that the notice and choice paradigm has failed in privacy, and that there is room for the FTC to expand its authority over “unfair . . . acts and practices” 52 15 U.S.C. §45. “ to reach certain privacy practices, I think both the problem and the FTC’s power to address that problem are broader based than they suggest. In an ideal world, courts would take the idea of assent seriously and refuse to enforce “contracts” that don’t actually bear any indicia of traditional contracts. 53 .See Lemley, Benefit of the Bargain, supra note 10, at 246. But unless and until they do, the FTC should abandon its reliance on the assumption that consumers made informed, voluntary choices to give up their rights merely because they visited a website or clicked a button that makes reference to terms placed somewhere on that website. While there is room for agreements, and even standard form agreements, to vary the baseline rules, the ubiquity of these pseudo-contracts has effectively replaced the common law and the statutory tools of antitrust and consumer protection. We have (generally old) consumer protection law on the books, but we effectively don’t have it in practice because we have contracted away both the rights and the ability to sue to enforce those rights. We need to broaden consumer protection law. 54 .See Rory Van Loo, Broadening Consumer Law: Competition, Protection, and Distribution, 95 Notre Dame L. Rev. 211, 213 (2019).
As these supposed agreements displace the common law and default contract rules that traditionally protected consumers, contract law must give way to regulatory, antitrust, and consumer protection law. The FTC can and should increase its regulatory oversight, targeting acts and practices that common law, the default rules of contract law, or good business practice would have prevented in a prior era. Whether or not they are “deceptive,” these practices are “unfair” in the traditional sense, and fall within the scope of the agency’s section 5 authority. The FTC (and the DOJ) should recognize that strong antitrust enforcement, particularly against mergers and collusive conduct, is also a form of consumer protection, since the absence of real choices undermines consumer sovereignty. And the agencies should use their authority to condition mergers on companies agreeing not to impose arbitration agreements, limits on class actions, or limits on private antitrust remedies. 55 Christopher Leslie and I have explained elsewhere that this is both within the agencies’ authority and indeed a standard practice in other agencies, such as the Securities and Exchange Commission. See Lemley & Leslie, supra note 45, at 54-60.
This regulatory approach isn’t ideal. A world in which consumers actually make informed decisions among real alternatives is an attractive one, and in that world agencies would be able to step back from the role of protecting them. 56 I articulate one vision of how we might reform contract law to make it more consumer-friendly in Lemley, Benefit of the Bargain, supra note 10, at 267-85. See also Hoffman, supra note 20, at 1409-24. But we don’t live in that world. Khan et al. are right to recognize this in the privacy space. I hope they and their successors at the FTC will see that as just one part of a larger picture.
* William H. Neukom Professor, Stanford Law School; of counsel, Lex Lumina LLP. Thanks to Rose Hagan and Dave Hoffman for comments on a prior draft.