# Terms of service and privacy policy: what each document is for A terms of service is a contract and a privacy policy is a notice. What the primary sources say about each, and the questions to bring to counsel. Canonical URL: https://worldenterprise.org/insights/terms-of-service-and-privacy-policy-what-each-document-is-for/ Last updated: 2026-10-10 Publisher: World Enterprise, run by World Enterprise Group Incorporated *General information as of October 10, 2026. It is not legal advice, and it describes United States federal sources, one California agency page and one European regulation. A lawyer can say what applies to a particular product and its users.* A product's legal pages are easy to treat as one item. They do different jobs. A terms of service sets out the terms on which people use the product, and in that sense it is a contract. A privacy policy tells people what the company does with their personal information, and in that sense it is a disclosure. This article uses primary sources to show where each document's authority comes from, why the two should not be blended, and which questions are worth taking to counsel. ## A terms of service is a contract The terms of service is the document the user is asked to accept, and what makes it matter is that it is meant to bind. A federal statute speaks to the form in which that can happen. The Electronic Signatures in Global and National Commerce Act, at 15 U.S.C. 7001, says that for a transaction in or affecting interstate or foreign commerce, a signature, contract or other record may not be denied legal effect, validity or enforceability solely because it is in electronic form, and that a contract may not be denied those qualities solely because an electronic signature or electronic record was used in its formation. Read carefully, that statement is narrow. It says an electronic form is not itself a reason for a contract to fail. It does not say that any particular on-screen flow produces an agreement, and it does not say that every term in an agreement is enforceable. Whether a given sign-up screen forms a binding agreement is a question of contract law that these sources do not address, and counsel can explain how the relevant courts treat it. ## Terms the law has already limited Some terms are not left to the drafter. The Consumer Review Fairness Act, at 15 U.S.C. 45b, defines a form contract as a contract with standardized terms used by a person in the course of selling or leasing, and imposed on an individual without a meaningful opportunity to negotiate. It says a provision of a form contract is void from the inception of the contract in certain cases, including where the provision imposes a penalty or fee for engaging in a covered communication, or transfers, or requires an individual to transfer, intellectual property rights in review or feedback content, other than a non-exclusive license. A covered communication is a written, oral or pictorial review, performance assessment or other similar analysis. The statute has more subsections than this article reads, including exceptions, so it is not a complete account. It does show something useful about the whole category: a company's standard terms are drafted against a background of rules that can make a clause void, whatever the drafter intended. The California Attorney General's CCPA page makes a similar point from the privacy side, saying a contract provision that waives CCPA rights is unenforceable. A template taken from another product carries its original author's choices and not a guarantee of fit. ## A privacy policy is a disclosure with several sources Where the terms of service takes its force from agreement, a privacy policy takes its content from laws that require a company to explain itself. The sources describe the requirement in different places. - **The GDPR.** Article 12 says the controller shall provide information to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language. Article 13 lists what must be provided when personal data are collected from the person, including the identity and contact details of the controller, the purposes and legal basis of the processing, the recipients or categories of recipients, and any intended transfer to a third country. - **The CCPA.** The California Attorney General's page says businesses subject to the law must give consumers certain notices explaining their privacy practices. It describes a right to be notified, before or at the point a business collects personal information. It also lists the right to opt out of the sale or sharing of personal information. - **The COPPA Rule.** Section 312.3 says an operator covered by the rule must provide notice on its website or online service of what information it collects from children, in addition to obtaining verifiable parental consent. The article on [privacy law basics](https://worldenterprise.org/insights/privacy-law-basics-for-a-small-product/) describes who each of those rules covers. The point here is a different one: each source asks for content, and the content has to be written down somewhere users can read it. Whether a particular page satisfies a particular rule is a question for counsel. ## The two documents meet at one rule The FTC Act, at 15 U.S.C. 45, declares unlawful unfair or deceptive acts or practices in or affecting commerce. It does not mention policies. But it explains why the two documents should be consistent with the product and with each other. A privacy policy is a statement the company makes about its own conduct, and a statement that does not match the conduct is the kind of thing a deception rule can reach. Counsel can say how the Commission has applied the provision to such statements; the sources read here do not. That is the practical risk of copying a policy from another company. The text describes the other company's practices. The questions below are meant to start with your own. ## Terms an agreement may address Terms of service are private documents and no source here standardizes them. These are the topics founders ask about, listed as questions to settle with counsel: - **Who is bound.** Who accepts the terms, and in what capacity: an individual, a company, a team administrator? - **What the user may do.** What uses does the product permit, and which does it prohibit? - **User content.** If users submit content, who owns it, and what license does the company need to operate the product? The article on [open-source licenses](https://worldenterprise.org/insights/open-source-licenses-inside-a-commercial-product/) shows how a license can grant and condition rights, which is the same structure. - **Payment and changes.** How are fees, renewals and changes to the terms handled, and how are users told? - **Ending the relationship.** When can each side end it, and what happens to data afterward? - **Disclaimers and liability.** What does the company disclaim, and what limits does it place on what it owes? Counsel can explain which of those limits a given law allows. - **Disputes.** Which law governs, and where are disagreements resolved? - **Reviews and feedback.** Does any clause restrict what customers may say about the product, and how does it sit with the Consumer Review Fairness Act? ## Who owns what behind the pages The pages also depend on documents the user never sees. The company's rights to its own code and brand depend on the founder agreements that assign them, which the article on [founder IP assignment and confidentiality agreements](https://worldenterprise.org/insights/founder-ip-assignment-and-confidentiality-agreements/) describes. A reviewer reading the company's files, as the [seed data room checklist](https://worldenterprise.org/library/seed-data-room-checklist/) shows, may read the public terms alongside those private ones. ## Questions to bring to counsel The [questions to ask your counsel before you sign](https://worldenterprise.org/insights/questions-to-ask-your-counsel-before-you-sign/) offers a general list. For these two documents: 1. What does the product collect, and does the privacy policy say so accurately? 2. Which of the notice requirements above apply to us, given our users? 3. How does a user accept the terms, and how do we keep a record of that? 4. Which clauses in our terms does the law limit or void? 5. How are changes to either document announced, and which version applied on a given date? 6. Do the two documents refer to each other consistently, and do they match the product's real behavior? 7. Who owns the task of updating them when the product changes? ## What this article cannot tell you It does not say what your terms or your policy should contain, and it provides no template. It does not say whether an on-screen flow forms a binding contract, which is a matter of contract law and case law it does not read. It describes a handful of federal statutes and rules, one California agency page and one European regulation. State consumer laws, sector rules and the laws of other countries are outside its scope, and it reads only part of the Consumer Review Fairness Act. It does not describe how courts have treated particular terms, and it gives no view on any specific clause. The sources were read on October 10, 2026. Statutes and agency pages change, so a decision should rest on current text and on a lawyer who has seen the product. ## Sources - 15 U.S. Code section 7001: General rule of validity. Legal Information Institute, Cornell Law School. - 15 U.S. Code section 45b: Consumer review protection. Legal Information Institute, Cornell Law School. - 15 U.S. Code section 45: Unfair methods of competition unlawful; prevention by Commission. Legal Information Institute, Cornell Law School. - Regulation (EU) 2016/679 (General Data Protection Regulation). EUR-Lex, Publications Office of the European Union. - California Consumer Privacy Act (CCPA). California Department of Justice, Office of the Attorney General. - 16 CFR section 312.3: Regulation of unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children on the internet. Legal Information Institute, Cornell Law School.