Website terms of service, a clause-by-clause guide for Australian businesses

The terms of service usually arrive in one of three ways: pasted into a checkout page by a developer, pulled from a template a friend's business uses, or sitting as a half-finished draft on your to-do list a week before launch. Whatever the path, the document is doing more work than it looks like. It is the contract between your business and everyone who visits, signs up or buys, and it decides what happens when a customer disputes a charge, a user posts something harmful on your site, or your platform goes down during a sale.

A well-drafted terms of service sets the rules of use, the price and fulfilment terms for what you sell, who owns the content on the site, and how disputes are resolved. It sits alongside your privacy policy, refunds statement and any collection notices, and it must not contradict them. What it cannot do is override the law: the consumer guarantees in the Australian Consumer Law (the ACL), Schedule 2 to the Competition and Consumer Act 2010 (Cth), apply no matter what the terms say, and since November 2023 an unfair term in a standard form consumer or small business contract can expose you to penalties as well as being void.

The clauses that do the real work

How users accept the terms

The acceptance clause is where the whole document stands or falls. Under the Electronic Transactions Act 1999 (Cth), a transaction is not invalid just because it happened by electronic communication (s 8). But validity and incorporation are different questions: a contract formed online only includes your terms if the user had reasonable notice of them.

The Federal Court mapped the practical spectrum in Dialogue Consulting Pty Ltd v Instagram, Inc [2020] FCA 1846. At one end is clickwrap, where a user ticks "I agree" before proceeding. In the middle is sign-in wrap, where a notice next to the sign-up button says that creating an account means agreeing to the terms, the arrangement the court accepted in that case. At the other end is browsewrap, where terms sit behind a footer link and the user never takes a positive step. eBay International AG v Creative Festival Entertainment Pty Ltd [2006] FCA 1768 shows the browsewrap risk in practice: ticket conditions that sat behind a hyperlink and were never drawn to the purchasers' attention were not incorporated into the contract, and the organiser's claim that it would detect and cancel every resold ticket was itself misleading conduct.

Clickwrap at the points that matter: require an active "I agree" at sign-up, checkout and app install rather than relying on passive links.
Notice near the action: put the link and a one-line summary where the user is actually clicking, not only in the footer.
Record the acceptance: log the version of the terms, the date and the user's agreement so you can prove incorporation later.
Don't rely on continued use: a clause saying "by using the site you accept these terms" is the weakest form of acceptance and the easiest to challenge.

What users can and can't do on your site

The conduct clause lists what is off limits: unlawful activity, harassment, spam, fraud, scraping, reverse engineering and uploading content that infringes someone else's rights. Its job is to give you a contractual hook to remove content, suspend accounts and, where the behaviour causes you loss, claim against the user.

Prohibited conduct: unlawful, harmful or fraudulent activity, spam and harassment.
Automated access: no scraping or bulk collection without your permission.
Software protection: no reverse engineering, decompiling or reselling access for software products.
Content rules: no infringing, defamatory or obscene uploads.

Keep the list proportionate. A clause that bans every imaginable behaviour can read as unreasonable, and rights you claim but cannot actually police create their own risk: in eBay v Creative Festival the court found that a representation the organiser could detect and cancel every resold ticket was misleading.

What you're selling, at what price, and how it's delivered

If you sell anything on the site, this clause is where the commercial deal lives: what you sell, in what currency and whether GST is included, how orders are placed and accepted, and when and how delivery or access happens. Courts and tribunals treat the printed process as the promise. A checkout that says next-day dispatch, or a subscription page that says monthly renewal, becomes part of what the customer bought.

Pricing and currency: AUD, GST-inclusive or exclusive, and who pays transaction fees.
Order acceptance: state when a contract forms, for example on dispatch confirmation rather than when the order is placed.
Fulfilment: delivery windows, digital access timeframes, and what happens when they are missed.
Subscriptions: billing cycle, renewal terms and how price changes are notified.

Misstated timeframes are a common source of complaints and disputes, and an advertised promise you cannot meet can also be misleading or deceptive conduct. Say what you actually do.

Refunds and the consumer guarantees you can't contract out of

The ACL's consumer guarantees apply to every supply of goods or services to a consumer, and s 64 of the ACL voids any term that excludes, restricts or modifies them. A "no refunds" or "all sales final" clause is void to the extent it touches a consumer guarantee. What a refund clause can do is set out how your process works: how a customer raises a fault, what you will do, whether repair, replacement or refund, the timeframes and proof of purchase.

For supplies that are not ordinarily acquired for personal, domestic or household use, s 64A of the ACL allows you to limit liability for a failure to comply with a guarantee to repairing or replacing the goods, or resupplying the services. That is the statutory space where a business-to-business limitation clause operates.

Statutory floor: consumer guarantees apply and cannot be excluded (s 64).
Business-to-business limits: repair, replacement or resupply caps under s 64A for non-consumer supplies.
Process: how to request a refund, the timeframes and proof of purchase.
Goodwill: an express policy for discretionary refunds beyond your legal obligations.

A refund policy that promises more than the law requires, or a warranty statement that misstates a customer's rights, is itself a compliance risk.

Disclaimers and caps on liability that stay enforceable

Disclaimers position responsibility for things outside your control: outages, third-party content, links and user posts. The limitation of liability clause caps what you will pay if something goes wrong. Both must respect two constraints.

First, they cannot touch the consumer guarantees, because s 64 of the ACL voids any term that does. Second, the unfair contract terms regime applies: a term of a standard form consumer or small business contract is unfair, and void, if it would cause a significant imbalance in the parties' rights and obligations, is not reasonably necessary to protect the legitimate interests of the party advantaged by it, and would cause detriment if applied or relied on (s 24 of the ACL). Since November 2023, proposing or relying on an unfair term can also attract a pecuniary penalty. For a corporation the maximum is the greater of $100 million, three times the benefit obtained, or 30% of adjusted turnover during the breach period (s 224 of the ACL).

Caps: limit liability to a defined amount, for example the fees paid in the previous 12 months.
Exclusions: carve out indirect or consequential loss where it is defensible.
Carve-outs: never cap liability for fraud, wilful misconduct or the consumer guarantees.
Transparency: the clearer and more legible the limitation, the harder it is to attack as unfair.

Intellectual property and user-generated content

The intellectual property clause works in two directions. First, it reserves your ownership of the site's content, software, logos and trade marks, and grants users only a limited licence to browse and use the site. Second, if users post reviews, comments or uploads, you need a licence from them to host and display that content, plus moderation and takedown rights.

Your ownership: reserve all rights in site content and branding.
User licence: limited, non-exclusive, revocable permission to use the site.
User content licence: users grant you the rights needed to host, display and, if you intend to, promote their posts.
Moderation: the right to remove unlawful, infringing or offensive material.

A "worldwide, perpetual, royalty-free" licence over everything a user posts can read as unfair to consumer contributors, and claiming ownership of user content outright is rarely what you need. Licence what you need, not everything imaginable.

Accounts, security and termination

The accounts clause sets the rules for registration, password security and acceptable use, and gives you the right to suspend or terminate access for breach. Termination rights are a frequent target of the unfair contract terms regime. A clause that lets you terminate at any time, for any reason, without notice or explanation will struggle to survive scrutiny.

Account rules: accurate registration details, one account per person where relevant, and password security expectations.
Suspension: the right to suspend for breach or security risk, ideally with notice.
Termination: when you can terminate, and what happens to user data and content afterwards.

Keep termination proportionate: immediate termination for serious breaches, notice and a chance to fix minor ones.

Privacy, data and cookies

The privacy clause does two things. It links to your privacy policy so users know how their personal information is handled, and it aligns your terms with your actual data practices. Under the Privacy Act 1988 (Cth), the Australian Privacy Principles bind APP entities. The small business exemption in s 6D generally exempts operators whose annual turnover for the previous financial year was $3 million or less, but the exemption does not apply if, for example, the business provides a health service and holds health information, trades in personal information, or is a contracted service provider for a Commonwealth contract. A small business can also choose to be treated as an APP entity (s 6EA).

Australia has no standalone cookie law, but cookies and tracking technologies that collect personal information fall within the Privacy Act, and the OAIC's guidance on tracking pixels makes clear this is an active enforcement area. If you send marketing emails or SMS, the Spam Act 2003 (Cth) requires consent and a functional unsubscribe facility (ss 16 and 18).

Privacy policy link: required for APP entities, best practice for everyone else.
Collection notice: a short notice at the point of capture, such as a sign-up form or checkout.
Cookies and tracking: disclose what is collected where personal information is involved.
Marketing consent: consent and unsubscribe obligations under the Spam Act.

The fastest way to create a regulator problem is terms that say one thing and a privacy policy that does another. Keep them consistent.

Governing law, changes to the terms and contact details

The governing law clause nominates Australian law and a state or territory jurisdiction, which keeps disputes at home rather than in a foreign forum. The changes clause sets out how you will notify users of updates and when they take effect. The contact clause gives users a channel for questions and complaints.

Governing law: Australian law, usually your home state or territory.
Changes: a notice method, an effective date and re-acceptance for material changes.
Contact details: a working channel for complaints and legal notices.

"We may change these terms at any time without notice" is exactly the kind of one-sided drafting the unfair contract terms regime targets. Give notice, and get re-acceptance for changes that matter.

Situational clauses worth adding

Some clauses only earn their place depending on how you operate:

Subscription and auto-renewal terms: if you bill on a recurring basis, set the cycle, renewal, price-change notice and how to cancel.
Competition rules: if you run giveaways or prize draws, dedicated terms state who can enter, how winners are chosen and how prizes are delivered.
API licence terms: if you expose an API, licence it separately from the site terms so integration clients have their own rules.
Marketplace terms: if buyers and sellers transact on your platform, separate terms for each side reflect their different roles and liabilities.
Age restrictions: if you sell age-restricted products or collect children's data, add an eligibility clause and verification steps.

How an Artificer Legal lawyer can help you finalise the terms

A terms of service looks simple until it is tested. An Artificer Legal practitioner would review your draft against the provisions that actually bite: the unfair contract terms test in ss 23 to 26 of the ACL, the non-excludable guarantees in s 64 and the business-to-business limitation space in s 64A, the Privacy Act 1988 exemption and its exceptions, and the Spam Act 2003 rules if you market by email or SMS.

Unfair terms review: audit each clause for imbalance, necessity and transparency, and redraft the ones that would not survive.
Liability and refund alignment: make sure caps, exclusions and refund wording sit inside the statutory floors.
Acceptance flow: advise on clickwrap implementation and what to record so incorporation can be proved.
Document set: align the terms with your privacy policy, collection notices and refunds statement.
Business-to-business negotiation: if a counterparty pushes back on your indemnities, caps or exclusions, negotiate the order and content of those clauses for you.

We would also help you decide which situational clauses your model actually needs, so you are not carrying risk you do not understand or drafting provisions you will never use.

Why the acceptance mechanism is the first thing a court looks for

The drafting choice that most often decides whether a terms of service works is the one at the very top: how acceptance happens. Every other clause, the liability cap, the refund policy, the governing law, only operates if the terms were part of the contract in the first place. eBay v Creative Festival shows what happens when they were not: a business with carefully drafted conditions could not rely on them because users were never given reasonable notice. Dialogue v Instagram shows the fix: a visible notice at the point of action, with a user step that records agreement. Build the acceptance step properly and the document has a foundation. Bury the terms in the footer and the rest of the drafting is decorative.

In short: make acceptance real and recorded, keep the conduct, pricing and delivery clauses accurate, respect the consumer guarantees and the unfair contract terms regime, align the privacy and marketing clauses with what you actually do, and get the governing law and change provisions right. A terms of service reviewed against those points will hold up in the situations where it matters: a dispute, a regulator inquiry or a court case.