/tos-clause-scanner

name: tos-clause-scanner
description: "Audit Terms of Service, user agreements, and privacy policies for consumer risks, producing a structured report that flags unfair clauses, data traps, and liability issues. Trigger when a user asks to review, audit, or analyze a ToS, privacy policy, or user agreement, or mentions specific concerns like auto-renewal or data authorization."
license: MIT

Terms of Service Auditor (Consumer Perspective)

Systematically audit the Terms of Service, User Agreements, and Privacy Policies of apps, SaaS products, and platforms from an ordinary consumer's standpoint. Identify clauses that may harm consumer rights and produce an actionable audit report.

Quick Start

Paste the terms text directly to the Agent or provide a file path. The Agent will automatically complete the audit and output a structured report.

**Example prompts:**

• "Review this user agreement for any unfair or one-sided clauses"
• "Analyze this app's privacy policy and flag any covert data authorizations"
• "Does this ToS have auto-renewal traps?"

---

1. Audit Framework

1.1 Risk Category Definitions

The audit covers seven major risk categories, each with common problem patterns:

| ID | Risk Category | Severity | Description | |----|---------------|----------|-------------| | R1 | Unfair Clauses | 🔴 High | Clauses that exclude or restrict consumers' statutory rights | | R2 | Covert Data Authorization | 🔴 High | Data collection, sharing, or sale beyond what the service requires | | R3 | Auto-Renewal Traps | 🟠 Medium-High | Opaque auto-renewal mechanisms and cancellation barriers | | R4 | Unilateral Amendment Rights | 🟠 Medium-High | Platform reserves the right to modify terms without notice | | R5 | Excessive Liability Disclaimers | 🟠 Medium-High | Overbroad disclaimers and low liability caps | | R6 | Dispute Resolution Restrictions | 🟡 Medium | Mandatory arbitration, class-action waivers, jurisdiction constraints | | R7 | IP Overreach | 🟡 Medium | Excessive rights claimed over user-generated content |

1.2 Typical Problem Patterns per Category

R1 Unfair Clauses

Look for these patterns:

• **Unilateral termination rights**: Platform may terminate a user's account at any time without cause
• **Asymmetric breach liability**: Users face heavy penalties for violations, but the platform's only remedy is a refund—or nothing at all
• **Irrevocable authorizations**: Requiring "irrevocable," "perpetual," "worldwide" broad-scope grants from the user
• **Deemed consent**: Continued use is treated as agreement to all terms with no option-by-option consent
• **"Final interpretation right" reserved by the platform**

**Review checklist:**

• Do the terms contain one-sided language such as "we reserve the right" or "we may at our sole discretion"?
• Are the user's obligations proportionate to the platform's obligations?
• Are there catch-all "blanket consent" clauses?

R2 Covert Data Authorization

Look for these patterns:

• **Excessive data collection**: Collecting data unrelated to the core service (e.g., a calculator app requesting contacts access)
• **Vague third-party sharing**: Using terms like "partners," "affiliates," or "third-party service providers" without specifying recipients
• **Opt-out-by-default data collection**: Personalized ads and behavioral tracking enabled by default rather than opt-in
• **High opt-out friction**: Difficult to disable data collection, or requires toggling off settings one by one
• **Vague data retention periods**: No clear retention timeframe, or use of phrases like "as long as necessary"
• **Cross-border data transfers**: Inadequate disclosure of where data is stored and transferred

**Review checklist:**

• Does the policy follow the principle of data minimization?
• Are third-party data recipients and purposes specifically listed?
• Does the user have a meaningful opt-out option?
• Is the data deletion process clear and actionable?

R3 Auto-Renewal Traps

Look for these patterns:

• **Trial-to-paid auto-conversion**: Automatic charges after a free trial ends, with no reminder before the trial expires
• **Complex cancellation process**: Canceling requires a phone call, email, or multi-step process, while subscribing takes a single click
• **Early billing window**: Renewal is locked in well before expiration (e.g., 24–72 hours ahead)
• **No pro-rata refunds**: No partial refund after an auto-renewal charge
• **Silent price changes**: Renewal price may change without prior notice

**Review checklist:**

• Is auto-renewal prominently disclosed during sign-up or purchase?
• Is canceling as easy as subscribing?
• Is there a pre-renewal reminder?
• Is the refund policy reasonable?

R4 Unilateral Amendment Rights

Look for these patterns:

• **No-notice modifications**: Platform reserves the right to change terms at any time without notifying users
• **Continued use equals consent**: Continued use after changes is treated as acceptance of the new terms
• **Retroactive effect**: New terms apply retroactively to past transactions or behavior

**Review checklist:**

• Is there a reasonable notification mechanism for changes (email, in-app message, push notification)?
• Is there a grace period for users to decide whether to continue using the service?
• Do material changes require fresh, explicit consent from users?

R5 Excessive Liability Disclaimers

Look for these patterns:

• **Blanket disclaimers**: "Under no circumstances shall we be liable for any direct, indirect, incidental, special, or consequential damages"
• **Extremely low liability caps**: Caps set at a trivially small amount (e.g., "fees paid in the past 12 months" or a fixed small sum)
• **Core obligation exclusions**: Disclaiming liability for defects in the service's core functionality
• **Overbroad force majeure**: Classifying system failures or cyberattacks as force majeure events

**Review checklist:**

• Is the scope of the disclaimer reasonable?
• Is t