If this is implemented, it probably would make sense to do so with the "forced profile completion" system (#478) that is currently used for httpauth logins and others, and in coordination with a new system of tracking when users have accepted rules (#3590).
i.e. The user logs in, the system sees they haven't agreed to the rules yet, so forces them to agree as a part of the forced profile completion screen.
i.e. The user logs in, the system sees they haven't agreed to the rules yet, so forces them to agree as a part of the forced profile completion screen.