Legal pages accessible without login or account creation

GDPR Art. 12(1) requires that privacy information be "easily accessible" — meaning accessible before users provide personal data, without requiring account creation. GDPR Art. 13 requires this disclosure at the point of collection. CCPA §1798.130(a)(5)(A) independently requires the privacy policy to be accessible to consumers "upon request" without authentication barriers. CWE-284 (Improper Access Control) classifies gating public legal information behind authentication as an access control defect. If legal pages are only visible after login, users cannot review the terms they are agreeing to before agreeing — which courts and regulators treat as coercive.

Explicitly exclude all legal page routes from your authentication middleware in middleware.ts. Never rely on a default-allow pattern — name the routes explicitly.

// middleware.ts — explicitly exclude legal pages
const PUBLIC_ROUTES = [
  '/',
  '/login',
  '/register',
  '/terms',
  '/privacy',
  '/privacy-policy',
  '/refund-policy',
  '/acceptable-use',
  '/dmca',
  '/legal',
]

export function middleware(req: NextRequest) {
  const { pathname } = req.nextUrl
  const isPublic = PUBLIC_ROUTES.some(
    route => pathname === route || pathname.startsWith(`${route}/`)
  )
  if (isPublic) return NextResponse.next()
  // ... your existing auth check
}

Verify by visiting /terms, /privacy, and any other legal routes in an incognito window with no session cookies. Each must return page content, not a login redirect.