Except I didn't make that claim, I edited the DOM to make the button read, "I haven't read this agreement and waive no rights." Even if I did not, how do they expect to be able to prove that I did not?

I am well within my rights to modify the copy of a contract supplied to me, so it can hardly be said to be fraudulent to do such a thing. It isn't my fault that they don't want a copy of what I actually agreed to...

I really would like to see someone use this tactic in court. I am quite curious what the legal status of it would be and what the follow up arms race would look like if it a court sided with the user in such a case. I can imagine naive counters where they submit hashes of the agreed upon contents and suddenly typoes become legally binding when they refuse to accept such a modification.

I believe that the outcome would be this:

You would go to court to sue Amazon. They would claim the suit should be dismissed because you had agreed to mandatory arbitration. You would claim you had NOT agreed to that clause, because you configured your browser to render different text before clicking on "I agree".

The court would then declare that since you had represented to Amazon that you were agreeing to it, they weren't responsible for what text you had changed in your browser, and the court would hold you to the contract that was supplied to you.

This isn't even a slight stretch. A stretch would be when Wells Fargo opened bank accounts for people without their permission -- then blocked a class action lawsuit arguing that the terms and conditions for the account (which the customers hadn't signed up for) required arbitration instead of class action lawsuits.[1]

[1] https://web.archive.org/web/20210428120303/https://www.nytim...

Maybe, but if that is the case, why even pretend to get consent? I have clearly not consented to waiving my rights in this scenario despite it maybe having no legal effect, if Amazon can simply dictate the terms of our business without any negotiation, why bother pretending? They can just post the terms and conditions somewhere on their site and then not bother forcing people to pretend to read them.

I once registered to an event where the condition of attendance was to agree to have your personal data processed (that was many years before GDPR came and made such bullshit illegal). This was declared through a HTML form, with a bit of client-side JS that disabled the "Submit" button until you checked the "I agree to data processing" checkbox.

So of course I edited the page to let the submission through anyway, and the POST request had the appropriate consent boolean parameter to false instead of true. Since the registration completed successfully, they either ignored that parameter, or - what I was hoping would happen - their database had my row with a distinct FALSE on the consent column.

I sometimes wonder what would have happened if I decided to follow up on their data processing against my consent. Would I have a successful case? Or would they can me for working around their bit of client-side JS?

How did you edit it? I haven't ever had Facebook, but if I understand correctly you are saying that you edited the terms of service and then successfully hit the "submit" button?

You can edit the content of any web site via the browser's dev tools. It's not hard. This only changes it locally, although it can have effects on poorly designed sites.

I have used this to buy tickets to an event for $1.

I once bought something with AJAX requests.

No, it wasn't unfair to the vendor. The vendor had an issue on a web site where the sales window closed, presumably to give the vendor time to process sales and print/mail tickets, but this was enforced front-end only. I was mid-check-out when the window closed with no warning.

There were plenty of tickets left. There was plenty of time left too (the vendor had switched from paper to digital tickets for COVID19, so...).

I think there was an exploitable security bug in there too, but I don't think anyone will exploit it. It's a little shop.

I was acquainted with the person who ran the event and website and let them know about the vulnerability and bought the tickets at the appropriate price after.

He was also storing passwords as plain text (they would email your password when you clicked "lost password?")... which is pretty troubling for a site that was also taking credit card payments.

In this circumstance there is no contract. There is no meeting of the minds.

In some jurisdictions it already is.

German / European courts have ruled many times that consumer TOS clauses which are "surprising" and/or "unusual" (e.g. "hidden" feed or waivers) are not enforceable.

Courts around the world have made similar rulings. The technical term is "contact of adhesion" and while exact rules vary from country to country, most courts will at a minimum strike out clauses which are considered to be "unexpected" on the basis that the customer is unlikely to have actually read the contract. (This is why clauses such as exclusions of liability are traditionally in all caps or bold -- on the theory that this draws attention to them and may help to save them.)

Thanks for going into further and teaching me the correct term for this.