D8: Best way to implement terms of use acceptance requirement AFTER log in, and gate content if they don't accept?
Specifically, the issue here is that the common Terms of Use modules out there happen during registration rather than after first log in. The problem scenario can arise if you are using a SSO implementation with your Drupal install.

My solution involved creating a module that, as a kernel event, redirected users that had not accepted the terms of use to the terms of use page until they had done so. Once they accepted the terms of use, I gave them a role - "Accepted Terms" - that let me know they were free to go.