Roku forced arbitration terms lockout
In early 2024, Roku made its televisions and streaming players unusable until their owners agreed to an updated set of Dispute Resolution Terms, presenting an accept-only on-screen notice with no option to decline.[1] The only way to opt out was to mail a written notice to Roku's general counsel within 30 days of the terms taking effect.[1] The terms kept a forced arbitration agreement barring customers from suing Roku or joining lawsuits against it, and Roku said the change was not related to a credential-stuffing data breach it disclosed weeks later.[1][2]
The terms change
[edit | edit source]Roku pushed the updated terms to existing customers through a full-screen message on their televisions and streaming players. The updated terms took effect on February 20, 2024, and by early March the notice was appearing on devices and blocking their use until the customer agreed.[1] TechCrunch's Devin Coldewey, who documented the rollout on March 5, 2024, wrote that "[t]here was no accessing the device without agreeing to the new terms."[1]
The notice allowed a customer to accept the terms but offered no button to decline. The only way to opt out was to mail a written notice to Roku's general counsel within 30 days of the terms taking effect, addressed to Stephen Kay, General Counsel, Roku, Inc., in San Jose, California, listing the customer's name, contact information, the email used to register the Roku account, and the product "at issue."[1] A forced arbitration agreement barring customers from suing Roku or joining lawsuits against it was already part of Roku's terms; what the 2024 update added was an "Informal Dispute Resolution" step requiring anyone with a legal complaint to first bring it to Roku's lawyers in a "Meet-and-Confer" call.[1]
Background
[edit | edit source]Forced arbitration clauses require a customer to resolve disputes through private arbitration rather than the courts. Writing about Roku's change, Gizmodo's Lucas Ropek said the agreement compelled users to accept forced arbitration and that, for companies, "the benefit of forced arbitration is that they can avoid class-action lawsuits."[3]
Timing relative to the 2024 data breaches
[edit | edit source]The updated terms took effect on February 20, 2024, and the accept-only notice began disabling devices in early March 2024. Roku disclosed a credential-stuffing data breach in early March 2024, and its security team had detected that intrusion between January 4 and February 21, 2024.[1][2][4] On March 11, 2024, BleepingComputer reported that a source told it the new Dispute Resolution Terms were "in part related to" the ongoing credential-stuffing attacks and financial fraud; after the article was published, Roku disputed this and stated that the new terms were not related to the hacked accounts.[2]
See also
[edit | edit source]References
[edit | edit source]- ↑ 1.0 1.1 1.2 1.3 1.4 1.5 1.6 1.7 Coldewey, Devin (5 Mar 2024). "Roku disables TVs and streaming devices until users consent to new terms". TechCrunch. Archived from the original on 15 Jan 2026. Retrieved 24 Aug 2026.
- ↑ 2.0 2.1 2.2 Toulas, Bill (11 Mar 2024). "Over 15,000 hacked Roku accounts sold for 50¢ each to buy hardware". BleepingComputer. Archived from the original on 31 Aug 2026. Retrieved 24 Aug 2026.
- ↑ Ropek, Lucas (6 Mar 2024). "Roku Will Bork Your TV Unless You Promise Not to Sue". Gizmodo. Archived from the original on 31 Aug 2026. Retrieved 24 Aug 2026.
- ↑ Hope, Alicia (22 Mar 2024). "Roku Data Breach: Over 15,000 Affected and Stored Credit Cards Used for Unauthorized Purchases". CPO Magazine. Archived from the original on 31 Aug 2026. Retrieved 24 Aug 2026.