I'll be honest I can imagine it's on risky legal ground. A stray y key hit when doing anything on the page accepts the agreement? For all their faults, all other implementations are much more explicit and resilient than this, as they require a targeted click.