Legal standing

Does a click hold up? Yes — when it’s built to the standard courts actually apply.

Courts don’t ask whether it was a signature. They ask whether the person had reasonable notice of the terms, took a clear affirmative act to accept them — and whether you can prove it. Clickwrap with conspicuous terms and an explicit click has a long record of being enforced; the failures are browsewrap, buried terms and missing records. Pacts is built to the winning pattern, plus the evidence.

See a sample certificateEvery source on this page
By region

United States · EU & UK · Latin America

United States

  • ESIGN (2000) and UETA: a contract or signature cannot be denied effect because it is electronic.
  • Enforced when notice is conspicuous and the click unambiguous — Berman v. Freedom Financial (9th Cir. 2022); Meyer v. Uber (2017).
  • Binds businesses too — Feldman v. Google (2007); Treiber & Straub v. UPS (2007). Losses come from buried terms and missing records.

EU & UK

  • eIDAS art. 25: an e-signature cannot be denied effect for being electronic or non-qualified.
  • B2B click-wrap counts as “in writing” when the terms can be saved and printed — CJEU, El Majdoub (2015).
  • GDPR art. 28: DPAs “in writing, including electronic form”. Changes must be notified and approved — not just published (EDPB 07/2020).

Latin America

  • Brazil: any method the parties accept is valid proof (MP 2.200-2 art. 10 §2; STJ, 2026). Qualified signatures only for listed acts.
  • Mexico: e-contracts are perfected on acceptance (CCom arts. 80, 89 bis, 93). Colombia: Ley 527 — same validity as a signature.
  • Argentina: click-to-accept is routinely enforced; formally a firma electrónica (Ley 25.506), so keep the record. Chile & Peru: same validity as handwritten.

Where clicks lose: buried terms and missing records — 76% of defendants couldn’t produce an acceptance record (Ironclad, 2021). What Pacts does:

Full text shown in the flow“I have read and agree” + Accept, per documentExact text hashed (SHA-256)Named contact, stated role, optional email codeAppend-only record, certificate exportNew version → tracked re-acceptance
43%

of clickwrap losses were screens that failed to give notice.

24%

of defendants could produce back-end records of the acceptance.

27 d → 2 h

Branch’s standard NDA after moving it to clickwrap; redlines eliminated.

Ironclad / PactSafe, Clickwrap Litigation Trends 2021 · Legal Dive, 2022. Full citations below.

Notice and assent

What the recipient saw.

  • The full text, in the flow — not a link to a PDF somewhere else.
  • One checkbox per document: “I have read and agree to …”, then Accept. Consent stays specific.
  • Optionally, a one-time code emailed to them — control of the inbox at the moment of acceptance.
  • No signature field, no account, no download: the pattern courts enforce, without the friction that invites a forward to legal.

Separate clicks for separate consents: a data-collection checkbox cannot double as assent to terms (Herzog v. Superior Court, Cal. App. 2024). Pacts records one acceptance per document.

The record

What you can produce — on demand.

In the litigation data, only 24% of defendants could produce a record of the acceptance. This is the record Pacts keeps for every click, and the certificate it prints from it.

  • Named contact and their stated role, acting for a named company
  • Timestamp, IP address and device, captured server-side — never self-reported
  • The exact text as shown, stored in full, with its SHA-256 hash
  • Append-only: no update or delete path exists, for anyone
  • A new version never silently replaces the old one — it is a new acceptance
See a sample certificate
Certificate of Acceptance
Data Processing Agreement — v3
Authority to bindEmail-verified
Maya Chen — authorized signer for Acme Media Ltd.
Accepted at
14 Aug 2026, 10:42:07 UTC
From
81.42.118.••• · Safari · iPhone
Affirmative action
Checked the document, selected Accept
Exact text
Stored in full · shown below
sha256 · 7f3c9a41d0b6e2a8c5f1…4e9b8e21b
Verified — the accepted text has not been altered.
Where clickwrap is the wrong tool

The boundaries, stated first.

Client-imposed paper

When a client’s procurement imposes its own PO, MSA or DPA, that is a negotiated contract. Large buyers’ terms often void click-through outright. Keep it in DocuSign; put everything standard on Pacts.

Qualified signatures and formal acts

Anything that needs a qualified or advanced signature, a notary, registration or an enforceable title (e.g. título executivo in Brazil) is not a clickwrap job — and rarely standard commercial terms.

DPA changes under GDPR

The controller must evaluate the terms, and changes must be notified and approved — publishing a new version is not compliance (EDPB 07/2020). Pacts shows the full text and asks again on every version.

Not legal advice. Pacts is not a law firm; confirm requirements for your contract types and jurisdictions with counsel.

Sources
  1. Ironclad / PactSafe, Clickwrap Litigation Trends, 2021 — 43% of losses were screens that failed to give notice; only 24% of defendants produced acceptance records
  2. Legal Dive, Dec 2022 — Branch: standard NDA 27 days → 2 hours, redlines eliminated
  3. Berman v. Freedom Financial Network (9th Cir. 2022)
  4. EDPB Guidelines 07/2020 on controller and processor — DPA changes must be notified and approved, not merely published
  5. AWS GDPR DPA · Google Cloud DPA · Stripe SSA · HubSpot DPA — bound by click or incorporation, no countersignature
  6. WorldCC / Deloitte, ROI of Contracting Excellence, 2023 — only 28% of sell-side agreements close on standard forms without negotiation

Send this page to counsel with a sample certificate — then put one standard agreement on Pacts and measure time-to-yes on your next five clients.

Send your first terms