diff --git a/tools/cldr-apps/js/src/esm/cldrCla.mjs b/tools/cldr-apps/js/src/esm/cldrCla.mjs
new file mode 100644
index 00000000000..90ce7eac47a
--- /dev/null
+++ b/tools/cldr-apps/js/src/esm/cldrCla.mjs
@@ -0,0 +1,58 @@
+import * as cldrClient from "../esm/cldrClient.mjs";
+import * as cldrNotify from "../esm/cldrNotify.mjs";
+/**
+ * see ClaSignature.java
+ * @typedef {Object} ClaSignature
+ * @property {boolean} corporate true if a corporate signature
+ * @property {string} email
+ * @property {string} employer
+ * @property {string} name
+ * @property {boolean} unauthorized true if cla load failed
+ * @property {boolean} readonly true if cla may not be modified
+ * @property {boolean} signed true if signed, always true when returned from getCla()
+ */
+
+/** @return {ClaSignature} signed cla if present otherwise null if not accessible */
+export async function getCla() {
+  try {
+    const client = await cldrClient.getClient();
+    const { body } = await client.apis.user.getCla();
+    return body;
+  } catch (e) {
+    if (e.statusCode === 401) {
+      return { unauthorized: true };
+    } else if (e.statusCode === 404) {
+      return { signed: false };
+    } else {
+      cldrNotify.exception(e, `trying to load CLA`);
+      throw e;
+    }
+  }
+}
+
+/**
+ * Attempt to sign.
+ * @throws {statusCode: 423} if the CLA may not be modified
+ * @throws {statusCode: 406} if there is an imput validation error
+ * @param {ClaSignature} cla
+ * @returns nothing if successful
+ */
+export async function signCla(cla) {
+  const client = await cldrClient.getClient();
+  const result = await client.apis.user.signCla(
+    {},
+    {
+      requestBody: cla,
+    }
+  );
+}
+
+/**
+ * Attempt to revoke.
+ * @throws {statusCode: 423} if the CLA may not be modified
+ * @throws {statusCode: 404} if the CLA was never signed
+ */
+export async function revokeCla() {
+  const client = await cldrClient.getClient();
+  const result = await client.apis.user.revokeCla();
+}
diff --git a/tools/cldr-apps/js/src/esm/cldrClient.mjs b/tools/cldr-apps/js/src/esm/cldrClient.mjs
index ab8df8ea773..972d8659015 100644
--- a/tools/cldr-apps/js/src/esm/cldrClient.mjs
+++ b/tools/cldr-apps/js/src/esm/cldrClient.mjs
@@ -3,8 +3,19 @@ import { getSessionId } from "./cldrStatus.mjs";
 import { SURVEY_TOOL_SESSION_HEADER } from "./cldrAjax.mjs";
 
 const OAS3_ROOT = "/openapi"; // Path to the 'openapi' (sibling to cldr-apps). Needs to be a host-relative URL.
+let client = null; // cached client object
+const RESOLVED_ROOT = new URL(OAS3_ROOT, document.baseURI); // workaround relative resolution issues
 
-const RESOLVED_ROOT = new URL(OAS3_ROOT, document.baseURI);
+function makeClient() {
+  return SwaggerClient({
+    url: RESOLVED_ROOT,
+    requestInterceptor: (obj) => {
+      // add the session header to each request
+      obj.headers[SURVEY_TOOL_SESSION_HEADER] = getSessionId();
+      return obj;
+    },
+  });
+}
 
 /**
  * Create a promise to a swagger client for ST operations.
@@ -17,15 +28,11 @@ const RESOLVED_ROOT = new URL(OAS3_ROOT, document.baseURI);
  *
  * @returns {Promise<SwaggerClient>}
  */
-async function getClient() {
-  return SwaggerClient({
-    url: RESOLVED_ROOT,
-    requestInterceptor: (obj) => {
-      // add the session header to each request
-      obj.headers[SURVEY_TOOL_SESSION_HEADER] = getSessionId();
-      return obj;
-    },
-  });
+function getClient() {
+  if (!client) {
+    client = makeClient();
+  }
+  return client;
 }
 
 export { getClient };
diff --git a/tools/cldr-apps/js/src/esm/cldrComponents.mjs b/tools/cldr-apps/js/src/esm/cldrComponents.mjs
index 3a63971d9c3..8a70afa6838 100644
--- a/tools/cldr-apps/js/src/esm/cldrComponents.mjs
+++ b/tools/cldr-apps/js/src/esm/cldrComponents.mjs
@@ -14,6 +14,7 @@ import LoginButton from "../views/LoginButton.vue";
 import OverallErrors from "../views/OverallErrors.vue";
 import ReportResponse from "../views/ReportResponse.vue";
 import SearchButton from "../views/SearchButton.vue";
+import SignCla from "../views/SignCla.vue";
 
 // 3rd party component(s)
 
@@ -90,6 +91,7 @@ function setup(app) {
   app.component("cldr-report-response", ReportResponse);
   app.component("cldr-searchbutton", SearchButton);
   app.component("cldr-value", CldrValue);
+  app.component("cldr-cla", SignCla);
 
   // some plugins we can pull in wholesale
   app.use(VueVirtualScroller);
diff --git a/tools/cldr-apps/js/src/esm/cldrNotify.mjs b/tools/cldr-apps/js/src/esm/cldrNotify.mjs
index f622926d3c9..8c6e0a3d86f 100644
--- a/tools/cldr-apps/js/src/esm/cldrNotify.mjs
+++ b/tools/cldr-apps/js/src/esm/cldrNotify.mjs
@@ -36,12 +36,14 @@ const NO_TIMEOUT = 0;
  *
  * @param {String} message the title, displayed at the top
  * @param {String} description the more detailed description
+ * @param {Function} onClick optional function called when clicking
  */
-function open(message, description) {
+function open(message, description, onClick) {
   notification.open({
     message: message,
     description: description,
     duration: MEDIUM_DURATION,
+    onClick,
   });
 }
 
diff --git a/tools/cldr-apps/js/src/esm/cldrText.mjs b/tools/cldr-apps/js/src/esm/cldrText.mjs
index d3991685e86..1ce2ab6cd98 100644
--- a/tools/cldr-apps/js/src/esm/cldrText.mjs
+++ b/tools/cldr-apps/js/src/esm/cldrText.mjs
@@ -488,6 +488,7 @@ const strings = {
   special_add_user: "Add a Survey Tool user",
   special_auto_import: "Import Old Winning Votes",
   special_bulk_close_posts: "Bulk Close Posts",
+  special_cla: "Contributor License Agreement",
   special_createAndLogin: "Create and Login",
   special_default: "Missing Page",
   special_dashboard: "Dashboard",
diff --git a/tools/cldr-apps/js/src/esm/cldrVueMap.mjs b/tools/cldr-apps/js/src/esm/cldrVueMap.mjs
index 7f396abdc74..bd011a588f1 100644
--- a/tools/cldr-apps/js/src/esm/cldrVueMap.mjs
+++ b/tools/cldr-apps/js/src/esm/cldrVueMap.mjs
@@ -8,6 +8,7 @@ import GenerateVxml from "../views/GenerateVxml.vue";
 import LockAccount from "../views/LockAccount.vue";
 import LookUp from "../views/LookUp.vue";
 import MainMenu from "../views/MainMenu.vue";
+import SignCla from "../views/SignCla.vue";
 import TestPanel from "../views/TestPanel.vue";
 import TransferVotes from "../views/TransferVotes.vue";
 import UnknownPanel from "../views/UnknownPanel.vue";
@@ -37,6 +38,7 @@ const specialToComponentMap = {
   upload: UploadPanel,
   vetting_participation2: VettingParticipation2,
   vsummary: VettingSummary,
+  cla: SignCla,
   // If no match, end up here
   default: UnknownPanel,
 };
diff --git a/tools/cldr-apps/js/src/md/cla.md b/tools/cldr-apps/js/src/md/cla.md
new file mode 100644
index 00000000000..2057b8ddf40
--- /dev/null
+++ b/tools/cldr-apps/js/src/md/cla.md
@@ -0,0 +1,4 @@
+# CLA not needed
+
+The SurveyTool is not currently requiring a CLA.
+For more details about the CLA, see [policy](https://www.unicode.org/policies/licensing_policy.html)
diff --git a/tools/cldr-apps/js/src/views/MainHeader.vue b/tools/cldr-apps/js/src/views/MainHeader.vue
index 46b77c9e032..9582b9472aa 100644
--- a/tools/cldr-apps/js/src/views/MainHeader.vue
+++ b/tools/cldr-apps/js/src/views/MainHeader.vue
@@ -21,7 +21,7 @@
           {{ unreadAnnouncementCount }}</a
         >
       </li>
-      <li v-if="coverageLevel">
+      <li v-if="coverageLevel && !needCla">
         <label for="coverageLevel">Coverage:</label>
         <select
           id="coverageLevel"
@@ -40,7 +40,7 @@
           </option>
         </select>
       </li>
-      <li v-if="voteCountMenu && voteCountMenu.length">
+      <li v-if="voteCountMenu && voteCountMenu.length && !needCla">
         <label for="voteLevelChanged">Votes:</label>
         <select
           id="voteLevelChanged"
@@ -57,6 +57,13 @@
           >Instructions</a
         >
       </li>
+      <a-alert
+        v-if="needCla"
+        @click="showCla"
+        message="CLA must be signed before data can be input"
+        type="error"
+        show-icon
+      />
       <li id="st-special-header" class="specialmessage">{{ specialHeader }}</li>
       <li>
         <a
@@ -116,6 +123,7 @@ export default {
       userName: null,
       voteCountMenu: null,
       voteLevelChanged: 0,
+      needCla: false,
     };
   },
 
@@ -173,6 +181,10 @@ export default {
         this.voteCountMenu = null;
         this.voteLevelChanged = 0;
       }
+
+      // only need CLA if logged in
+      this.needCla = !!user && !user.claSigned;
+
       this.sessionMessage = cldrStatus.getSessionMessage();
       this.specialHeader = cldrStatus.getSpecialHeader();
       this.stVersion = "Survey Tool " + cldrStatus.getNewVersion();
@@ -199,6 +211,10 @@ export default {
         ? "You have " + n + " unread announcement(s)"
         : "";
     },
+
+    showCla() {
+      window.location.replace("#cla///");
+    },
   },
 };
 </script>
diff --git a/tools/cldr-apps/js/src/views/MainMenu.vue b/tools/cldr-apps/js/src/views/MainMenu.vue
index 1acbb88629a..2621f4b3ff6 100644
--- a/tools/cldr-apps/js/src/views/MainMenu.vue
+++ b/tools/cldr-apps/js/src/views/MainMenu.vue
@@ -9,6 +9,7 @@
       <li>
         <ul>
           <li><a href="#account///">Account Settings</a></li>
+          <li v-if="showClaMenu"><a href="#cla///">Sign CLA</a></li>
         </ul>
       </li>
       <li v-if="!isAdmin && !accountLocked">
@@ -154,6 +155,7 @@ export default {
       recentActivityUrl: null,
       uploadXmlUrl: null,
       userId: 0,
+      showClaMenu: false, // off by default, see CLDR-16499
     };
   },
 
diff --git a/tools/cldr-apps/js/src/views/SignCla.vue b/tools/cldr-apps/js/src/views/SignCla.vue
new file mode 100644
index 00000000000..3f3def5191c
--- /dev/null
+++ b/tools/cldr-apps/js/src/views/SignCla.vue
@@ -0,0 +1,214 @@
+<template>
+  <div>
+    <a-alert
+      v-if="needCla"
+      type="warning"
+      message="Please read and sign the below CLA to begin contributing."
+      show-icon
+    />
+    <a-alert
+      v-else-if="readonlyCla"
+      type="info"
+      message="Your organization has signed the CLA, it may not be modified."
+      show-icon
+    />
+    <a-alert
+      v-else
+      type="success"
+      message="The CLA has been signed"
+      show-icon
+    />
+
+    <!-- CLA text -->
+    <a-spin v-if="loading" />
+    <div class="cla" v-html="claHtml" />
+    <hr />
+    <div>
+      Your Name:
+      <a-input :disabled="!needCla" v-model:value="userName">
+        <template #prefix>
+          <i class="glyphicon glyphicon-user" />
+        </template>
+      </a-input>
+      Your Email:
+      <a-input :disabled="!needCla" v-model:value="userEmail">
+        <template #prefix>
+          <i class="glyphicon glyphicon-envelope" />
+        </template>
+      </a-input>
+      Your Employer (or 'none'):<a-input
+        :disabled="!needCla"
+        v-model:value="userEmployer"
+      >
+        <template #prefix>
+          <i class="glyphicon glyphicon-briefcase" />
+        </template>
+      </a-input>
+      <i class="pleaseChoose" v-if="needCla && userSign == 0"
+        >Please choose one:</i
+      ><br />
+      <a-radio-group :disabled="!needCla" v-model:value="userSign">
+        <a-radio :style="radioStyle" :value="1">
+          My employer has already signed the CLA and is listed on Unicode’s
+          <a href="https://www.unicode.org/policies/corporate-cla-list/"
+            >List of Corporate CLAs</a
+          >.
+        </a-radio>
+        <a-radio :style="radioStyle" :value="2">
+          I am a self-employed or unemployed individual and I have read and
+          agree to the CLA.
+        </a-radio>
+      </a-radio-group>
+      <br />
+      <button
+        @click="sign"
+        v-if="
+          needCla &&
+          userSign != 0 &&
+          userName &&
+          userEmail &&
+          userEmployer &&
+          !readonlyCla
+        "
+      >
+        Sign
+      </button>
+      <a-alert
+        type="info"
+        v-else-if="needCla"
+        message="Please fill in the above fields."
+      />
+      <hr />
+    </div>
+    <div v-if="!needCla">
+      <a-alert
+        v-if="!readonlyCla"
+        type="warning"
+        message="If the CLA is revoked, you will not be able to continue contributing to CLDR. You will have an opportunity to re-sign if corrections are needed."
+      />
+      <button v-if="!readonlyCla" @click="revoke">Revoke</button>
+    </div>
+    <a-spin v-if="loading" />
+  </div>
+</template>
+
+<script setup>
+import * as cldrCla from "../esm/cldrCla.mjs";
+import { marked } from "../esm/cldrMarked.mjs";
+import * as cldrNotify from "../esm/cldrNotify.mjs";
+import * as cldrStatus from "../esm/cldrStatus.mjs";
+
+import { ref } from "vue";
+import claMd from "../md/cla.md";
+
+const claHtml = marked(claMd);
+
+const user = cldrStatus.getSurveyUser();
+
+if (!user) window.location.replace("#///"); // need a user
+
+let readonlyCla = ref(false);
+let needCla = ref(!user?.claSigned);
+let loading = ref(false);
+const userName = ref(user?.name);
+const userEmail = ref(user?.email);
+let userEmployer = ref(user?.org);
+let userSign = ref(0);
+const radioStyle = {
+  display: "flex",
+};
+
+async function loadData() {
+  if (!user) return;
+  loading.value = true;
+  const { corporate, email, employer, name, readonly, unauthorized, signed } =
+    await cldrCla.getCla();
+  loading.value = false;
+  if (unauthorized || !signed) return;
+  readonlyCla.value = readonly;
+  userName.value = name;
+  userEmail.value = email;
+  userEmployer.value = employer;
+  userSign.value = corporate ? 1 : 2;
+}
+
+// load the existing signing data
+loadData().then(
+  () => {},
+  (err) => cldrNotify.exception(err, "Loading prior CLA data")
+);
+
+async function sign() {
+  loading.value = true;
+  try {
+    await cldrCla.signCla({
+      email: userEmail.value, // unwrap refs
+      name: userName.value,
+      employer: userEmployer.value,
+      corporate: userSign == 1,
+    });
+    user.claSigned = true; // update global user obj
+    needCla.value = false;
+    cldrNotify.open(
+      `CLA Signed`,
+      `The CLA has been signed. You may now contribute to the SurveyTool!`,
+      () => (window.location.hash = "#///")
+    );
+  } catch (e) {
+    if (e.statusCode === 423) {
+      cldrNotify.error(
+        "CLA Sign error",
+        "Your organization has already signed the CLA, it cannot be modified."
+      );
+    } else if (e.statusCode == 406) {
+      cldrNotify.error(
+        "CLA Error",
+        `Double check your input fields, the CLA could not be signed.`
+      );
+    } else {
+      cldrNotify.exception(
+        e,
+        `${e.statusCode || "error"} trying to sign the CLA.`
+      );
+    }
+  }
+  loading.value = false;
+}
+
+async function revoke() {
+  loading.value = true;
+  try {
+    await cldrCla.revokeCla();
+    needCla.value = true;
+    user.claSigned = false; // update global user obj
+    cldrNotify.open(`CLA Revoked`, `The CLA has been revoked.`);
+  } catch (e) {
+    if (e.statusCode === 423) {
+      cldrNotify.error(
+        "CLA Revoke error",
+        "Your organization signed the CLA, it cannot be modified."
+      );
+    } else if (e.statusCode === 404) {
+      cldrNotify.error("CLA Revoke error", "You have not signed the CLA.");
+      needCla.value = true;
+      user.claSigned = false; // update global user obj
+    } else {
+      cldrNotify.exception(
+        e,
+        `${e.statusCode || "error"} trying to revoke a CLA.`
+      );
+    }
+  }
+  loading.value = false;
+}
+</script>
+
+<style scoped>
+.cla {
+  padding: 1em;
+  border: 1px solid gray;
+  margin: 0.5em;
+  background-color: bisque;
+  font-size: small;
+}
+</style>
diff --git a/tools/cldr-apps/js/webpack-test.config.js b/tools/cldr-apps/js/webpack-test.config.js
index 2eb7729d3ed..058a6bc907e 100644
--- a/tools/cldr-apps/js/webpack-test.config.js
+++ b/tools/cldr-apps/js/webpack-test.config.js
@@ -16,6 +16,7 @@ module.exports = {
   devtool: "source-map",
   module: {
     rules: [
+      // keep in sync with webpack.config.js
       {
         test: /\.css$/i,
         use: ["style-loader", "css-loader"],
@@ -24,7 +25,11 @@ module.exports = {
         test: /\.vue$/,
         loader: "vue-loader",
       },
-    ],
+      {
+        test: /\.md$/,
+        type: 'asset/source',
+      },
+  ],
   },
   plugins: [
     new VueLoaderPlugin(),
diff --git a/tools/cldr-apps/js/webpack.config.js b/tools/cldr-apps/js/webpack.config.js
index 4965e5d295e..78bf7427254 100644
--- a/tools/cldr-apps/js/webpack.config.js
+++ b/tools/cldr-apps/js/webpack.config.js
@@ -42,6 +42,7 @@ module.exports = (env, argv) => {
     devtool: DEV ? "eval-cheap-module-source-map" : "source-map",
     module: {
       rules: [
+        // keep in sync with webpack-test.config.js
         {
           test: /\.css$/i,
           use: ["style-loader", "css-loader"],
@@ -50,6 +51,10 @@ module.exports = (env, argv) => {
           test: /\.vue$/,
           loader: "vue-loader",
         },
+        {
+          test: /\.md$/,
+          type: 'asset/source',
+        },
       ],
     },
     resolve: {
diff --git a/tools/cldr-apps/src/main/java/org/unicode/cldr/web/ClaSignature.java b/tools/cldr-apps/src/main/java/org/unicode/cldr/web/ClaSignature.java
new file mode 100644
index 00000000000..8778c22b831
--- /dev/null
+++ b/tools/cldr-apps/src/main/java/org/unicode/cldr/web/ClaSignature.java
@@ -0,0 +1,72 @@
+package org.unicode.cldr.web;
+
+import java.util.Date;
+import java.util.EnumSet;
+import org.eclipse.microprofile.openapi.annotations.media.Schema;
+import org.unicode.cldr.util.Organization;
+
+public final class ClaSignature {
+    /**
+     * If TRUE, then CLAs are NOT required by default unless the REQUIRE_CLA property is set. At
+     * present (CLDR-16499) this facility is not activated by default.
+     */
+    public static final boolean DO_NOT_REQURE_CLA = true;
+
+    public static final String CLA_KEY = "SignedCla";
+    public String email;
+    public String name;
+    public String employer; // May be different than org!
+    public boolean corporate; // signed as corporate
+
+    @Schema(required = false)
+    public Date signed;
+
+    @Schema(description = "CLA is fixed by organization and cannot be changed", required = false)
+    public boolean readonly;
+
+    public boolean valid() {
+        if (email.isBlank()) return false;
+        if (name.isBlank()) return false;
+        if (employer.isBlank()) return false;
+        if (corporate && employer.equals("none")) return false;
+        return true;
+    }
+
+    /**
+     * Organizations which are known to have signed the CLA. Update this from
+     * https://www.unicode.org/policies/corporate-cla-list/
+     */
+    public static final EnumSet<Organization> CLA_ORGS =
+            EnumSet.of(
+                    Organization.adobe,
+                    Organization.apple,
+                    Organization.cherokee,
+                    Organization.google,
+                    Organization.ibm,
+                    Organization.meta,
+                    Organization.microsoft,
+                    Organization.mozilla,
+                    Organization.sil,
+                    Organization.wikimedia,
+                    Organization.surveytool);
+
+    public ClaSignature() {}
+
+    public ClaSignature(Organization o) {
+        this.email = "";
+        this.name = "Corporate CLA - " + o.name();
+        this.employer = o.toString();
+        this.corporate = true;
+        this.signed = new Date(0);
+        this.readonly = true;
+    }
+
+    public ClaSignature(String string) {
+        this.email = "";
+        this.name = "Testing CLA: " + string;
+        this.employer = "Testing CLA";
+        this.corporate = true;
+        this.signed = new Date(0);
+        this.readonly = true;
+    }
+}
diff --git a/tools/cldr-apps/src/main/java/org/unicode/cldr/web/UserRegistry.java b/tools/cldr-apps/src/main/java/org/unicode/cldr/web/UserRegistry.java
index 727a383c313..04715f2633a 100644
--- a/tools/cldr-apps/src/main/java/org/unicode/cldr/web/UserRegistry.java
+++ b/tools/cldr-apps/src/main/java/org/unicode/cldr/web/UserRegistry.java
@@ -205,6 +205,9 @@ public class User implements Comparable<User>, UserInfo, JSONString {
         @Schema(hidden = true)
         private String emailmd5 = null;
 
+        @Schema(description = "True if CLA is signed")
+        public boolean claSigned = false;
+
         public String getEmailHash() {
             if (emailmd5 == null) {
                 String newHash = DigestUtils.md5Hex(email.trim().toLowerCase());
@@ -480,6 +483,7 @@ public String toJSONString() throws JSONException {
                     .put("org", vrOrg().name())
                     .put("orgName", vrOrg().getDisplayName())
                     .put("id", id)
+                    .put("claSigned", claSigned)
                     .toString();
         }
 
@@ -556,6 +560,43 @@ public CLDRLocale exampleLocale() {
             }
             return null;
         }
+
+        public void signCla(ClaSignature cla) {
+            if (ClaSignature.CLA_ORGS.contains(getOrganization())) {
+                throw new IllegalArgumentException("Cannot modify CLA for a listed org");
+            }
+            if (!cla.valid()) throw new IllegalArgumentException("Invalid CLA");
+            cla.signed = new Date();
+            settings().setJson(ClaSignature.CLA_KEY, cla);
+            claSigned = true;
+        }
+
+        public boolean revokeCla() {
+            if (ClaSignature.CLA_ORGS.contains(getOrganization())) {
+                return false;
+            }
+            final String oldCla = settings().get(ClaSignature.CLA_KEY, null);
+            if (oldCla == null || oldCla.isBlank()) {
+                return false;
+            }
+            settings().set(ClaSignature.CLA_KEY, "");
+            claSigned = false;
+            return true;
+        }
+
+        public ClaSignature getCla() {
+            CLDRConfig config = CLDRConfig.getInstance();
+            if (config.getEnvironment() == Environment.UNITTEST) {
+                return new ClaSignature("UNITTEST");
+            } else if (ClaSignature.DO_NOT_REQURE_CLA
+                    && !config.getProperty("REQUIRE_CLA", false)) {
+                // no CLA needed unless CLDR_NEED_CLA is true.
+                return new ClaSignature("DO_NOT_REQURE_CLA");
+            } else if (ClaSignature.CLA_ORGS.contains(getOrganization())) {
+                return new ClaSignature(getOrganization());
+            }
+            return settings().getJson(ClaSignature.CLA_KEY, ClaSignature.class);
+        }
     }
 
     public static void printPasswordLink(WebContext ctx, String email, String password) {
@@ -835,6 +876,9 @@ public UserRegistry.User getInfo(int id) {
                         infoArray = new UserRegistry.User[newchunk];
                         arraySize = newchunk;
                     }
+
+                    u.claSigned = (u.getCla() != null);
+
                     infoArray[id] = u;
                     // good so far..
                     if (rs.next()) {
@@ -955,6 +999,7 @@ public UserRegistry.User get(String pass, String email, String ip, boolean letme
             u.locales = rs.getString(5);
             u.intlocs = rs.getString(6);
             u.last_connect = rs.getTimestamp(7);
+            u.claSigned = (u.getCla() != null);
 
             // good so far..
 
@@ -1865,7 +1910,8 @@ public enum ModifyDenial {
         DENY_PHASE_CLOSED("SurveyTool is in 'closed' phase"),
         DENY_NO_RIGHTS("User does not have any voting rights"),
         DENY_LOCALE_LIST("User does not have rights to vote for this locale"),
-        DENY_PHASE_FINAL_TESTING("SurveyTool is in the 'final testing' phase");
+        DENY_PHASE_FINAL_TESTING("SurveyTool is in the 'final testing' phase"),
+        DENY_CLA_NOT_SIGNED("CLA is not signed");
 
         ModifyDenial(String reason) {
             this.reason = reason;
@@ -1888,6 +1934,7 @@ public static boolean userCanAccessForum(User u, CLDRLocale locale) {
 
     private static Object userCanAccessForumWhy(User u, CLDRLocale locale) {
         if (u == null) return ModifyDenial.DENY_NULL_USER; // no user, no dice
+        if (!u.claSigned) return ModifyDenial.DENY_CLA_NOT_SIGNED;
         if (!userIsGuest(u)) return ModifyDenial.DENY_NO_RIGHTS; // at least guest level
         if (userIsAdmin(u)) return null; // Admin can modify all
         if (userIsTC(u)) return null; // TC can modify all
@@ -1947,6 +1994,7 @@ public static ModifyDenial countUserVoteForLocaleWhy(User u, CLDRLocale locale)
     }
 
     public static ModifyDenial userCanModifyLocaleWhy(User u, CLDRLocale locale) {
+        if (u != null && !u.claSigned) return ModifyDenial.DENY_CLA_NOT_SIGNED;
         final ModifyDenial denyCountVote = countUserVoteForLocaleWhy(u, locale);
 
         // If we don't count the votes, modify is prohibited.
diff --git a/tools/cldr-apps/src/main/java/org/unicode/cldr/web/UserSettings.java b/tools/cldr-apps/src/main/java/org/unicode/cldr/web/UserSettings.java
index 9021554aeee..7193bebabcb 100644
--- a/tools/cldr-apps/src/main/java/org/unicode/cldr/web/UserSettings.java
+++ b/tools/cldr-apps/src/main/java/org/unicode/cldr/web/UserSettings.java
@@ -2,6 +2,8 @@
 
 package org.unicode.cldr.web;
 
+import com.google.gson.Gson;
+
 public abstract class UserSettings implements Comparable<UserSettings> {
     /**
      * Get a string, or the default
@@ -88,4 +90,16 @@ public void set(String name, boolean value) {
     public boolean persistent() {
         return false;
     }
+
+    public void setJson(String name, Object o) {
+        final Gson gson = new Gson();
+        set(name, gson.toJson(o));
+    }
+
+    public <T> T getJson(String name, Class<T> clazz) {
+        final Gson gson = new Gson();
+        final String j = get(name, null);
+        if (j == null || j.isBlank()) return null;
+        return gson.fromJson(j, clazz);
+    }
 }
diff --git a/tools/cldr-apps/src/main/java/org/unicode/cldr/web/api/UserAPI.java b/tools/cldr-apps/src/main/java/org/unicode/cldr/web/api/UserAPI.java
index f76ec5475c0..df03496ada7 100644
--- a/tools/cldr-apps/src/main/java/org/unicode/cldr/web/api/UserAPI.java
+++ b/tools/cldr-apps/src/main/java/org/unicode/cldr/web/api/UserAPI.java
@@ -1,7 +1,10 @@
 package org.unicode.cldr.web.api;
 
+import javax.ws.rs.Consumes;
+import javax.ws.rs.DELETE;
 import javax.ws.rs.GET;
 import javax.ws.rs.HeaderParam;
+import javax.ws.rs.PUT;
 import javax.ws.rs.Path;
 import javax.ws.rs.PathParam;
 import javax.ws.rs.Produces;
@@ -15,6 +18,7 @@
 import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.unicode.cldr.util.VoteResolver.Level;
+import org.unicode.cldr.web.ClaSignature;
 import org.unicode.cldr.web.CookieSession;
 import org.unicode.cldr.web.UserRegistry;
 import org.unicode.cldr.web.UserRegistry.User;
@@ -31,6 +35,9 @@ public static final class UserInfo {
         public final String name;
         public final int userid;
 
+        @Schema(description = "CLA is signed, if false no permission to contribute.")
+        public final boolean claSigned;
+
         public UserInfo(int userid) {
             this.userid = userid;
             // Logged out user, no info
@@ -39,6 +46,7 @@ public UserInfo(int userid) {
             this.org = null;
             this.emailHash = null;
             this.name = "User #" + userid;
+            this.claSigned = false; // TODO
         }
 
         public UserInfo(User u) {
@@ -48,6 +56,7 @@ public UserInfo(User u) {
             this.level = u.getLevel();
             this.name = u.name;
             this.userid = u.id;
+            this.claSigned = u.claSigned;
         }
     }
 
@@ -85,4 +94,81 @@ public Response getUserInfo(
         }
         return Response.ok(new UserInfo(u)).build();
     }
+
+    @PUT
+    @Operation(summary = "Sign CLA", description = "mark user as signing the CLA")
+    @Consumes(MediaType.APPLICATION_JSON)
+    @APIResponses(
+            value = {
+                @APIResponse(responseCode = "202", description = "Accepted CLA"),
+                @APIResponse(responseCode = "401", description = "Unauthorized"),
+                @APIResponse(responseCode = "406", description = "Parameter error"),
+                @APIResponse(responseCode = "423", description = "cannot modify org CLA")
+            })
+    @Path("/cla")
+    public Response signCla(@HeaderParam(Auth.SESSION_HEADER) String session, ClaSignature cla) {
+        final CookieSession mySession = Auth.getSession(session);
+        if (mySession == null || mySession.user == null) {
+            return Response.status(401).build();
+        }
+        if (ClaSignature.CLA_ORGS.contains(mySession.user.getOrganization())) {
+            return Response.status(423, "Cannot modify org CLA").build();
+        }
+        if (!cla.valid()) {
+            return Response.status(406, "invalid CLA parameters").build();
+        }
+        mySession.user.signCla(cla);
+        return Response.status(202, "ok").build();
+    }
+
+    @DELETE
+    @Operation(summary = "Revoke CLA", description = "mark user as not signing the CLA")
+    @APIResponses(
+            value = {
+                @APIResponse(responseCode = "202", description = "removed"),
+                @APIResponse(responseCode = "401", description = "unauthorized"),
+                @APIResponse(responseCode = "404", description = "not found"),
+                @APIResponse(responseCode = "423", description = "cannot modify org CLA")
+            })
+    @Path("/cla")
+    public Response revokeCla(@HeaderParam(Auth.SESSION_HEADER) String session) {
+        final CookieSession mySession = Auth.getSession(session);
+        if (mySession == null || mySession.user == null) {
+            return Response.status(401).build();
+        }
+        if (ClaSignature.CLA_ORGS.contains(mySession.user.getOrganization())) {
+            return Response.status(423, "Cannot modify org CLA").build();
+        }
+        if (!mySession.user.revokeCla()) {
+            return Response.status(404, "not found").build();
+        }
+        return Response.status(202, "ok").build();
+    }
+
+    @GET
+    @Operation(summary = "Get CLA", description = "Get CLA info")
+    @APIResponses(
+            value = {
+                @APIResponse(
+                        responseCode = "200",
+                        description = "CLA info",
+                        content =
+                                @Content(
+                                        mediaType = "application/json",
+                                        schema = @Schema(implementation = ClaSignature.class))),
+                @APIResponse(responseCode = "401", description = "unauthorized"),
+                @APIResponse(responseCode = "404", description = "not found")
+            })
+    @Path("/cla")
+    public Response getCla(@HeaderParam(Auth.SESSION_HEADER) String session) {
+        final CookieSession mySession = Auth.getSession(session);
+        if (mySession == null || mySession.user == null) {
+            return Response.status(401).build();
+        }
+        final ClaSignature cla = mySession.user.getCla();
+        if (cla == null) {
+            return Response.status(404, "not found").build();
+        }
+        return Response.ok(cla).build();
+    }
 }
diff --git a/tools/cldr-apps/src/main/java/org/unicode/cldr/web/api/VoteAPI.java b/tools/cldr-apps/src/main/java/org/unicode/cldr/web/api/VoteAPI.java
index df988c0072f..0f30b231970 100644
--- a/tools/cldr-apps/src/main/java/org/unicode/cldr/web/api/VoteAPI.java
+++ b/tools/cldr-apps/src/main/java/org/unicode/cldr/web/api/VoteAPI.java
@@ -32,6 +32,7 @@
 import org.unicode.cldr.web.DataPage;
 import org.unicode.cldr.web.SubtypeToURLMap;
 import org.unicode.cldr.web.SurveyForum;
+import org.unicode.cldr.web.UserRegistry.ModifyDenial;
 import org.unicode.cldr.web.api.VoteAPIHelper.VoteEntry;
 
 @Path("/voting")
@@ -302,7 +303,8 @@ public void setOneRowPath(String xpstrid) {
                         description = "Authorization required, send a valid session id"),
                 @APIResponse(
                         responseCode = "403",
-                        description = "Forbidden, no access to make this vote"),
+                        description =
+                                "Forbidden, no access to make this vote (also used when CLA not signed)"),
                 @APIResponse(
                         responseCode = "500",
                         description = "Internal Server Error",
@@ -332,6 +334,12 @@ public Response vote(
         if (xp == null) {
             return Response.status(Response.Status.NOT_FOUND).build(); // no XPath found
         }
+        if (!mySession.user.claSigned) {
+            return Response.status(
+                            Response.Status.FORBIDDEN.getStatusCode(),
+                            ModifyDenial.DENY_CLA_NOT_SIGNED.getReason())
+                    .build();
+        }
         return VoteAPIHelper.handleVote(
                 loc,
                 xp,