# Terms of Service & Privacy Policy agreement notice missing when forum log-in is forced

**URL:** https://meta.discourse.org/t/terms-of-service-privacy-policy-agreement-notice-missing-when-forum-log-in-is-forced/305744
**Category:** Bug
**Created:** [April 28, 2024, 12:30am UTC](https://meta.discourse.org/t/terms-of-service-privacy-policy-agreement-notice-missing-when-forum-log-in-is-forced/305744 "2024-04-28T00:30:20Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![KhoiUSA](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/khoiusa/32/373010_2.png) [@KhoiUSA](https://meta.discourse.org/u/KhoiUSA)
#### Post date: [April 28, 2024, 12:30am UTC](https://meta.discourse.org/t/terms-of-service-privacy-policy-agreement-notice-missing-when-forum-log-in-is-forced/305744/1 "2024-04-28T00:30:20Z")

</div>

My forum currently has the `login required` setting enabled where anonymous users are forced to log in or register on the site. I have noticed that the text “By registering, you agree to the privacy policy and terms of service.” is missing when the setting is enabled. When it isn’t, the text is visible. I believe the text should be visible so users know they are subject to the terms of service and privacy policy when joining the forum.

`login required` Setting Enabled:

 ![image](https://global.discourse-cdn.com/meta/original/4X/8/1/7/817cd3760949a675ae04940131d25cdb26723c63.png)

`login required` Setting Disabled:

 ![image](https://global.discourse-cdn.com/meta/original/4X/4/0/f/40f08cd703a7938995332540a71bf56db7c3ed7f.png)

---

<div class="post-metadata">

### Author: ![ondrej](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ondrej/32/198804_2.png) [@ondrej](https://meta.discourse.org/u/ondrej)
#### Post date: [April 28, 2024, 9:07am UTC](https://meta.discourse.org/t/terms-of-service-privacy-policy-agreement-notice-missing-when-forum-log-in-is-forced/305744/2 "2024-04-28T09:07:53Z")

</div>

It makes sense on a login only community. On Meta or example if you click ToS it takes you to [here](https://meta.discourse.org/tos) which is ‘inside’ the site. That defeats the point of login only.

---

<div class="post-metadata">

### Author: ![KhoiUSA](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/khoiusa/32/373010_2.png) [@KhoiUSA](https://meta.discourse.org/u/KhoiUSA)
#### Post date: [April 28, 2024, 11:46am UTC](https://meta.discourse.org/t/terms-of-service-privacy-policy-agreement-notice-missing-when-forum-log-in-is-forced/305744/3 "2024-04-28T11:46:54Z")

</div>

I see, although I noticed that even on login-only sites, the pages `/tos` and `/privacy` are still accessible to the public internet even when anonymous. The UI is also restricted on these pages. For notifying users they are legally binded to the terms of service and privacy policy, I think it’s best to have that agreement notice on login-only sites.

---

<div class="post-metadata">

### Author: ![awesomerobot](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/awesomerobot/32/142900_2.png) [@awesomerobot](https://meta.discourse.org/u/awesomerobot)
#### Post date: [April 29, 2024, 3:07pm UTC](https://meta.discourse.org/t/terms-of-service-privacy-policy-agreement-notice-missing-when-forum-log-in-is-forced/305744/4 "2024-04-29T15:07:14Z")

</div>

Yes, we should probably show this disclaimer unconditionally… I’ve attempted a PR here: [UX: show disclaimer on account creation unconditionally by awesomerobot · Pull Request #26807 · discourse/discourse · GitHub](https://github.com/discourse/discourse/pull/26807)

but there might be some more complicating factors to consider…

---

<div class="post-metadata">

### Author: ![angus](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/angus/32/341715_2.png) [@angus](https://meta.discourse.org/u/angus)
#### Post date: [November 20, 2024, 8:51pm UTC](https://meta.discourse.org/t/terms-of-service-privacy-policy-agreement-notice-missing-when-forum-log-in-is-forced/305744/5 "2024-11-20T20:51:04Z")

</div>

I just encountered this. I think it probably qualifies as a “bug”. For example, given the following site settings:

- `login required` is true
- `tos url` is filled
- `privacy policy url` is filled

The Disclaimer text should definitely appear on signup / invite modals (and currently does not).

---

<div class="post-metadata">

### Author: ![pmusaraj](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pmusaraj/32/119489_2.png) [@pmusaraj](https://meta.discourse.org/u/pmusaraj)
#### Post date: [September 24, 2025, 12:29pm UTC](https://meta.discourse.org/t/terms-of-service-privacy-policy-agreement-notice-missing-when-forum-log-in-is-forced/305744/6 "2025-09-24T12:29:26Z")

</div>

This should be fixed now via [FIX: Include TOS and Privacy Policy URLs in signup when login required by pmusaraj · Pull Request #34926 · discourse/discourse · GitHub](https://github.com/discourse/discourse/pull/34926), thanks for the report!
