A Privacy Policy and a Terms of Use serve completely different legal purposes, protect different parties, and are required under different laws — yet they are frequently confused, combined incorrectly, or omitted entirely. This guide explains exactly what each document covers, which one is legally mandatory for your site, what each must contain to satisfy major regulations including GDPR, and how to manage both documents as your service evolves.
What is a Privacy Policy?
A Privacy Policy is a legal document that discloses how your website or application collects, uses, stores, and shares personal data belonging to your users. It is written for users — its purpose is to inform them about their data rights and your data practices so they can make informed decisions about whether to use your service.
What counts as personal data
Personal data is any information that can identify a natural person, directly or indirectly. This is broader than most people realise. It includes obvious identifiers like names, email addresses, and phone numbers, but also less obvious ones: IP addresses, cookie identifiers, device fingerprints, location data, and even combinations of data that together identify someone. If your website sets any cookies, collects contact form submissions, or logs server access data, you are collecting personal data.
Who is it for and why does it exist
The legal obligation to have a Privacy Policy comes from data protection regulators, not courts. GDPR (EU), CalOPPA (California), PIPEDA (Canada), LGPD (Brazil), and POPIA (South Africa) all independently require that any entity collecting personal data from residents of their jurisdiction disclose its data practices. App store policies from Apple and Google add further requirements — any app that collects user data must link to a compliant Privacy Policy in its store listing.
Note
What is a Terms of Use?
A Terms of Use (also called Terms of Service, Terms and Conditions, or User Agreement) is a contract between you and your users that governs how they may interact with your service. Unlike a Privacy Policy, it is not primarily concerned with data — it sets the rules of engagement, limits your liability, protects your intellectual property, and establishes what happens when disputes arise.
A contract without consideration is not a contract. Your Terms of Use is only enforceable if users have a genuine opportunity to read and accept it before they begin using your service.
What a Terms of Use governs
- Permitted and prohibited uses — what users may and may not do on your platform
- Intellectual property — who owns the content, what licence users grant you, and what you licence to them
- Liability limitations — caps on damages, disclaimers of warranties, and indemnification requirements
- Account termination — grounds on which you may suspend or terminate user accounts
- Dispute resolution — arbitration clauses, class-action waivers, and the governing law and jurisdiction
- Modification rights — how and when you can change the terms and how users are notified
Is a Terms of Use legally required?
No specific law mandates a Terms of Use document the way data protection laws mandate a Privacy Policy. However, without one, you have no contractual basis for enforcing rules against misuse, no documented liability caps, and no clear intellectual property assignment from user-generated content. For any service beyond a purely informational blog, operating without a Terms of Use is a significant business risk even though it is not technically illegal.
Tip
Key differences between the two
The confusion between these two documents is understandable — both are legal agreements displayed on websites, and both use similar formal language. But their purpose, legal basis, and consequences for non-compliance are completely different.
| Aspect | Privacy Policy | Terms of Use |
|---|---|---|
| Primary purpose | Inform users about data practices | Set rules for service use |
| Protects | Users (their data rights) | The business (liability, IP) |
| Legally mandatory? | ✓ Yes — when collecting personal data | ✗ No — but strongly recommended |
| Regulated by | GDPR, CalOPPA, CCPA, PIPEDA, etc. | Contract and consumer protection law |
| Written for | Users, regulators, app stores | Users and courts |
| Requires user consent? | ✓ In some jurisdictions (GDPR) | ✓ Implied acceptance or click-wrap |
| Update notification | ✓ Required by GDPR for material changes | ✓ Required if terms change |
| Can combine into one? | ✗ Should remain separate | ✗ Should remain separate |
Combining both documents into a single "Terms and Privacy Policy" file is a common mistake. Regulators expect them to be separate because they serve distinct functions. A GDPR supervisory authority reviewing your Privacy Policy should not need to read through your liability limitations and arbitration clauses to find the data processing disclosures. Keep them as separate, clearly linked documents.
Which one do you legally need?
The answer depends on your site type, your users' locations, and whether you collect any personal data. The practical decision tree is short.
Do you collect personal data from users?
If yes — and "yes" includes setting any cookies, collecting email addresses, logging IP addresses, or using analytics tools like Google Analytics — you need a Privacy Policy. This is true regardless of how large or small your site is. The GDPR applies to any organisation processing data about EU residents regardless of where the organisation is based.
Do you have registered users, paid accounts, or user-generated content?
If yes, you also need a Terms of Use. Any service where users create accounts, pay for access, or post content needs enforceable rules governing those relationships. Without terms, you have no contractual basis to terminate a user who violates your rules, no clear IP assignment from their content, and no documented liability limitations.
Check app store and advertising network requirements
Apple App Store requires a Privacy Policy link for any app that collects user data. Google Play requires a Privacy Policy link for all apps. Google AdSense requires a Privacy Policy disclosing the use of cookies and third-party advertising as a condition of account approval. If your site earns advertising revenue, a compliant Privacy Policy is a prerequisite for monetisation, not just a compliance exercise.
Assess your jurisdiction exposure
If any of your users are in the EU or UK, GDPR and UK GDPR apply regardless of your company location. If any are in California, CalOPPA and the CCPA may apply. If any are in Brazil, LGPD applies. Most public websites with international traffic are subject to multiple privacy laws simultaneously — the practical approach is to write a Privacy Policy that satisfies the most stringent applicable regulation (typically GDPR).
Consent Text Readability Checker
Score your Privacy Policy or Terms of Use for reading grade level and plain-language compliance — GDPR requires that privacy notices be written in clear, understandable language.
What each document must contain
The specific required contents depend on your jurisdiction, but there is substantial overlap in what major privacy laws require. Using the most comprehensive standard as your baseline — GDPR — produces a policy that satisfies most other privacy regulations as well.
Required Privacy Policy contents under GDPR
- Identity of the data controller — your legal name, registered address, and contact details
- Data Protection Officer contact — required for certain organisations; optional but good practice for others
- Categories of data collected — specifically what personal data you collect and from which sources
- Legal basis for processing — for each data category, which GDPR legal basis applies (consent, legitimate interest, contract, legal obligation)
- Purpose and retention period — how each data category is used and how long it is kept
- Third-party sharing — every third party that receives personal data, including analytics and advertising providers
- User rights — access, rectification, erasure, portability, objection, restriction, and how to exercise them
- Supervisory authority — the right to lodge a complaint with the relevant data protection authority
Required Terms of Use contents
There is no legal checklist for Terms of Use contents — they are contracts, and contract requirements vary by jurisdiction and service type. The standard commercial clauses you should include are: acceptance mechanism (click-wrap or browse-wrap), eligibility requirements (age, jurisdiction), licence grant to use the service, intellectual property ownership and prohibited uses, user-generated content licences (if applicable), warranty disclaimers, limitation of liability, indemnification, dispute resolution and governing law, and the modification process.
The "last updated" date requirement
Both documents must display the date they were last materially revised. This is both a legal requirement under GDPR and a practical necessity — users need to know which version they are reading and whether it has changed since they last reviewed it. When you update either document, always update the date, notify users as required, and use the Terms and Privacy Diff Viewer to generate a clear summary of what changed for your notification text.
Warning
Keeping your policies current
Policies are not one-time documents. Every time you add a new analytics tool, change your data retention period, integrate a new payment processor, or expand into a new jurisdiction, your Privacy Policy may need updating. A Terms of Use needs updating when you add new features, change your pricing model, or need to respond to a new category of user misuse.
Using a diff viewer for policy updates
Tracking what changed between policy versions is essential for two reasons: you need to know what to include in your user notification, and regulators may ask for a history of policy changes during an audit. The Terms and Privacy Diff Viewer compares your old and new versions at the section level, highlights changed text, and flags sensitive terms like "sell", "share with third parties", and "transfer" that require particular attention in user communications. This makes the update process auditable and the notification text straightforward to draft.
When to notify users
GDPR requires notice of material changes to your Privacy Policy before the changes take effect — typically via email to registered users plus a banner on the site. What counts as "material" includes any new data collection category, any new third-party sharing, any change to retention periods, and any new international data transfer. Minor grammatical corrections or reordering of sections without substantive change typically do not require formal notification, though updating the date is still required.
Terms and Privacy Diff Viewer
Compare your old and new policy versions with section-level diffs and sensitive-term detection — makes drafting user change notifications straightforward and keeps your update history auditable.
Common mistakes and edge cases
Most policy problems on real websites fall into a predictable set of mistakes. Knowing them in advance is far cheaper than discovering them during a regulator inquiry or a legal dispute.
Using a generic template without customisation
A free generator template creates a policy that describes a generic website's data practices — not yours. If the template says "we do not use cookies" but your site uses Google Analytics, you are publicly misrepresenting your data practices. Every template must be reviewed and edited to accurately describe your actual data flows before publishing. The Consent Text Readability Checker helps ensure the text, once customised, is still readable and not buried in legal jargon.
Combining both documents into one
Some sites publish a single "Terms and Privacy Policy" document. Regulators dislike this because it makes the privacy disclosures harder to locate — GDPR requires that privacy information be "easily accessible." More practically, it makes the documents harder to update independently and harder for users to find the specific information they are looking for. Keep them as separate linked pages.
Failing to address cookies and the cookie banner relationship
A Privacy Policy that discloses cookie use must be referenced from your cookie consent banner. The banner asks for consent; the Privacy Policy explains what that consent covers. If your banner links to a page that does not actually describe the cookies in use, the consent is invalid under GDPR. Use the Cookie Banner Compliance Checker to verify that your banner implementation and your Privacy Policy references are consistent, and the Consent Mode Validator to confirm your technical consent mode implementation signals match your stated policy.
Warning
Key takeaways
- A Privacy Policy informs users about data practices and is legally mandatory when you collect personal data — including cookies and analytics.
- A Terms of Use sets the rules for using your service and protects your business — it is not legally required but creates significant liability exposure without one.
- GDPR, CalOPPA, CCPA, and most app store policies require a Privacy Policy; the threshold is collecting any personal data from users in those jurisdictions.
- Keep both documents as separate, clearly linked pages — combining them makes the Privacy Policy harder for regulators and users to find.
- Use the Consent Text Readability Checker to confirm your policy meets the GDPR plain-language requirement.
- Every material policy update requires notifying users before the change takes effect — use the Terms and Privacy Diff Viewer to document what changed.
- A generic template must be customised to your actual data practices before publishing — an inaccurate policy is worse than a simple but accurate one.