Are Your Online Arbitration Clauses Actually Enforceable?

Enterprises have spent the last decade moving dispute resolution online, amending Terms of Service and Dispute Resolution Policies to route customer disputes to arbitration, with consent captured through a click.

The logic has always been simple: no valid consent, no valid arbitration clause, and no valid award. Indian courts have repeatedly struck down arbitration awards where the underlying clause could not be shown to reflect genuine, informed consent.

Two developments in particular mean a business relying on a 2019-style clickwrap arbitration clause for consumer contracts in India needs to rethink its approach, not just refresh its wording.

The big shift: consumers can no longer be forced into arbitration

The most important change is not about how clickwrap consent is captured, it's about whether an arbitration clause can bind an Indian consumer at all.

In M. Hemalatha Devi v. B. Udayasri (2024) 4 SCC 255, the Supreme Court of India held that consumer disputes are non-arbitrable by default. Even where a valid, signed (or clicked) arbitration clause exists, a consumer who chooses instead to approach a Consumer Forum under the Consumer Protection Act, 2019 cannot be compelled into arbitrationṣ.

The Court treated consumer protection law as welfare legislation serving a public policy purpose that a private contract cannot override, the choice of forum belongs to the consumer alone.

In March 2025, in Citicorp Finance (India) Ltd. v. Snehasis Nanda, the Supreme Court cited and applied the same principle, that arbitration in a consumer dispute is available only "at the exclusive choice of the 'consumer' alone", though that case was ultimately decided on a different, narrower ground (the respondent was found not to qualify as a "consumer" at all, for

M. Hemalatha Devi and Others v. B. Udayasri, Civil Appeal Nos. 6500–6501 of 2023, decided 5 October 2023 (reported at (2024) 4 SCC 255), full judgment: https://api.sci.gov.in/supremecourt/2023/5812/5812_2023_2_1501_47347_FinalOrder_05-Oct-2023.pdf

Same judgment as above; see paragraphs 9–17 for the Court's reasoning on non-arbitrability of consumer disputes as a matter of public policy.

lack of privity of contract with the appellant). The arbitration point is best read as the Court reaffirming Hemalatha Devi in passing, not as an independent new ruling on the same scale.

This builds on the Court's earlier position in Emaar MGF Land Ltd. v. Aftab Singh (2019) 12 SCC 751, but Hemalatha Devi makes the rule considerably harder to work around: it no longer matters who filed first, or how clearly the arbitration clause was drafted and consented to. If the counterparty qualifies as a "consumer," arbitration is available only if they choose it after the dispute arises.

What this means in practice: if your website's Terms and Conditions route B2C disputes to mandatory arbitration, that clause is now vulnerable in India regardless of how well it was clicked through.

Businesses relying on clickwrap arbitration clauses to keep consumer disputes out of public fora should not treat a well-drafted, well-documented clickwrap as a guarantee that arbitration will be the forum.

It remains a valid contractual mechanism for B2B agreements and for consumers who voluntarily opt into arbitration once a dispute exists, but it is no longer a reliable shield against consumer forums.

What are clickwrap agreements?

A clickwrap agreement is a digital contract where a user must click a button, "I Agree," "I Accept," "OK," "I Consent", before downloading content, completing a purchase, or using a service.

It differs from a browsewrap agreement, where terms are simply posted on a site without requiring any affirmative action. Courts across jurisdictions continue to treat this distinction as decisive: clickwrap agreements provide evidence of a user's affirmative assent, while browsewrap terms generally do not, and browsewrap arbitration clauses are far less likely to be enforced.

Citicorp Finance (India) Ltd. v. Snehasis Nanda, Civil Appeal No. 14157 of 2024, decided 20 March 2025 (reported as 2025 SCC OnLine SC 594), full judgment: https://api.sci.gov.in/supremecourt/2023/21755/21755_2023_16_1501_60208_Judgement_20-Mar-2025.pdf. See paragraphs 24–25 for the discussion of Hemalatha Devi.

Emaar MGF Land Ltd. v. Aftab Singh, (2019) 12 SCC 751, discussed and quoted at length within the Hemalatha Devi judgment cited in note 1 above (paragraphs 11–18).

On the clickwrap/browsewrap distinction and current judicial trend toward stricter notice requirements, see "From Clickwrap to the Courtroom: Enforcing Online Arbitration Clauses," Lexology, October 2025, https://www.lexology.com/library/detail.aspx?g=5271c492-63b2-4cc7-a418-14394219ef63.

Clickwrap agreements are typically unilateral, standard-form contracts covering Terms of Use, Privacy Policies, or End-User License Agreements, and users can decline by closing the site or clicking "I Disagree."

How courts assess enforceability

International case law

• Specht v. Netscape Communications Corp., 306 F.3d 17 (2d Cir. 2002), remains good law: an arbitration clause is unenforceable if it is not clearly and conspicuously presented to the user before they act.
• Feldman v. Google, Inc., 513 F. Supp. 2d 229 (E.D. Pa. 2007), courts continue to enforce clickwrap terms where the user could not have completed the transaction without clicking through them.
• Hotmail Corp. v. Van Money Pie Inc., 1998 WL 388389 (N.D. Cal.), the foundational case establishing that clicking "I Agree" after being shown terms creates a binding contract.
• Berman v. Freedom Financial Network, LLC, 30 F.4th 849 (9th Cir. 2022), a more recent and increasingly cited case; courts have become more, not less, exacting about conspicuousness, holding that a hyperlink alone does not put a reasonable user on notice of terms.
• Chilutti v. Uber Technologies, Inc., a Pennsylvania appellate decision (2023) declined to enforce Uber's arbitration clause on notice grounds; the Pennsylvania Supreme Court granted review, and the case remains a live signal that even large, well-resourced platforms are still losing on interface and notice design.

The trend across these cases is consistent: courts have not relaxed scrutiny of clickwrap design since 2020, if anything, the bar for "reasonable notice" has risen as courts have grown more familiar with dark-pattern UI tactics.

The Indian scenario

Contract formation through electronic means has long been recognised in India. In Trimex International FZE v. Vedanta Aluminium Ltd., the Supreme Court held that a contract concluded through an exchange of emails, with clear terms, is valid and enforceable.

Berman v. Freedom Financial Network, LLC, 30 F.4th 849 (9th Cir. 2022), official Ninth Circuit opinion: https://cdn.ca9.uscourts.gov/datastore/opinions/2022/04/05/20-16900.pdf ; also summarized at Justia: https://law.justia.com/cases/federal/appellate-courts/ca9/20-16900/20-16900-2022-04-05.html

Chilutti v. Uber Technologies, Inc., 300 A.3d 430 (Pa. Super. Ct. 2023), review granted by the Pennsylvania Supreme Court, 325 A.3d 446 (Pa. 2024), matter remains pending; treat this as a live, unresolved case rather than settled precedent, and confirm current status before citing it as authority.

In DDIT (LT), Mumbai v. Gujarat Pipavav Port Ltd., the tribunal noted that mass-market adhesion contracts, of which clickwrap agreements are a digital example, can still be struck down as unconscionable even where they otherwise meet the formal requirements of a contract.

On the evidentiary side, there has been a genuine statutory change since the original version of this article: the Indian Evidence Act, 1872 was repealed and replaced by the Bharatiya Sakshya Adhiniyam, 2023 (BSA), in force from 1 July 2024.

The provision on admissibility of electronic records, formerly Section 65-B, is now Section 63 of the BSA. The core four-condition test carries over, but Section 63(4) now requires a certificate signed by both the person in a responsible position over the relevant device and an independent technical expert, and it must disclose the record's hash value.

For any business relying on clickwrap logs as evidence of consent in Indian litigation, this is the current standard your consent-capture certificates need to satisfy, not the old single-signatory Section 65-B format.

Section 10-A of the Information Technology Act, 2000, continues to give legal recognition to contracts formed through electronic means.

No Supreme Court ruling has held that clickwrap contracts are categorically invalid in India; the open question has always been evidentiary, whether you can prove what was agreed to, by whom, and when.

The second major shift: the DPDP Act and Rules

The other change with direct bearing on how you design consent flows is data protection law. India's Digital Personal Data Protection Act, 2023 was finally operationalised when the Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025, alongside the constitution of the Data Protection Board of India.

On Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (in force 1 July 2024, replacing Section 65-B of the Indian Evidence Act, 1872), see "Section 63 BSA 2023: Admissibility of Electronic Evidence," KS&K, https://ksandk.com/litigation/section-63-bharatiya-sakshya-adhiniyam-2023/. For the bare statutory text, consult the official Bharatiya Sakshya Adhiniyam, 2023 (Act No. 47 of 2023) on the India Code portal (https://www.indiacode.nic.in).

 "Government notifies DPDP Rules to empower citizens and protect privacy," Press Information Bureau, Government of India, 14 November 2025, https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190014&reg=3&lang=2

• Compliance is being phased in over 18 months, but the direction is clear and directly affects clickwrap design:
• Consent for processing personal data must be captured through a separate, standalone notice written in clear, plain language, not buried inside a general Terms of Service document.
• The notice must specify the exact purpose of data collection; bundling data-processing consent into a general "I Agree to the Terms" click is no longer good practice, and will not meet the DPDP Rules' notice standard.
• Consent must be as easy to withdraw as it was to give, through a clearly signposted mechanism.
• Verifiable parental consent is required before processing a child's personal data, with limited carve-outs.

For any enterprise redesigning clickwrap flows in 2026, the practical implication is that your arbitration-clause consent and your data-processing consent should probably not be captured by the same undifferentiated click.

Courts assessing "informed consent" for an arbitration clause, and the Data Protection Board assessing consent for data processing, are now applying two different, and both increasingly strict, standards.

Designing a clickwrap agreement that can withstand scrutiny in 2026

1. Active, unbundled consent. Users must affirmatively click "I Agree" or equivalent; boxes should never be pre-checked. Where the click also covers data processing, follow the DPDP Rules' expectation of a standalone, specific notice rather than a single omnibus checkbox.
2. Conspicuous presentation before the transaction. Following Specht and Berman, a hyperlink at the bottom of a page is not enough. Terms, especially the arbitration clause, should be presented prominently and require scrolling or acknowledgment before checkout or sign-up completes.
3. Plain language. Terms should be comprehensible to a layperson, not just a lawyer. This is now also a statutory expectation under the DPDP Rules for data-related notices, not merely a best practice for contract enforceability.
4. Re-consent on material changes. If you revise your Terms, including the arbitration clause, require users to re-accept the updated version; don't rely on continued use as acceptance.
5. Distinguish sensitive or secondary consents. Uses like marketing communications or third-party data sharing should be opted into separately, not folded into the general Terms acceptance. On specific consent-notice obligations under the DPDP Rules, 2025, see "Digital Personal Data Protection Rules, 2025: Operationalising consent, security, and governance obligations," Lexology, November 2025, https://www.lexology.com/library/detail.aspx?g=7e3af947-10aa-4712-bc1e-54179a613409
6. Documentation, with the current evidentiary standard in mind. Keep timestamped, version-controlled records of what was accepted and when. If this evidence may need to, go before an Indian court, prepare it to satisfy Section 63 of the BSA, 2023 including the dual-signatory certificate, rather than the older Section 65-B format.
7. Uncluttered, honest screen design. Keep the layout simple, avoid dark patterns (pre-ticked boxes, disguised "accept" buttons, contrasting colours designed to draw attention away from the decline option), and ensure the full notice can be read without excessive scrolling through unrelated content.
8. For B2C contracts, plan for arbitration as an option, not a shield. Given Hemalatha Devi and Citicorp Finance, don't design your dispute-resolution strategy around the assumption that a consumer's clickwrap acceptance forecloses their access to a consumer forum. Invest in genuinely responsive internal grievance-redressal processes, courts are pointing to their absence as a reason consumers turn to public fora in the first place.

Conclusion

Well-designed clickwrap agreements remain enforceable, and the design principles that made them defensible in 2019, active consent, conspicuous notice, plain language, and solid documentation, are still the foundation.

But two things have moved since then: Indian consumer-arbitration law has shifted decisively in the consumer's favour, and data-protection consent now carries its own, separate statutory bar to clear.

Enterprises revisiting their online arbitration clauses in 2026 should treat this as an opportunity to rebuild consent flows around both standards at once, rather than assuming the old clickwrap playbook still covers both jobs.