When to update your website terms and conditions, what the law requires

A website's terms and conditions sit quietly at the bottom of most Australian business sites, and for good reason. They set the rules for using the site, limit liability, protect intellectual property, and record what customers can expect when they buy from you. There is no law that says every website must publish them, and nothing in Australian legislation prescribes a fixed interval for rewriting them. The obligation that does exist is more demanding than a calendar date: your terms are a statement of how you do business, and consumer law will hold you to that statement. Terms that are out of date, that contradict the law, or that were never brought to anyone's attention can be void, unenforceable, or a source of penalties.

This guide sets out who those obligations apply to, the duties that should trigger an update, what happens when terms go stale, and a checklist you can work through.

Who these obligations apply to

There is no turnover test for most of this. If your website sells goods or services to Australian consumers, or even promotes them, the Australian Consumer Law (ACL) applies to you. The ACL is Schedule 2 of the Competition and Consumer Act 2010 (Cth), and it bites at different points:

• Misleading conduct: s 18 of the ACL prohibits misleading or deceptive conduct in trade or commerce, with no size or industry threshold.
• Consumer guarantees: these apply to supplies to consumers, defined in s 3 of the ACL as people who acquire goods or services for $100,000 or less, or goods of a kind ordinarily acquired for personal, domestic or household use.
• Unfair contract terms: the rules apply to standard form contracts with consumers and with small businesses, where a small business employs fewer than 100 people or has a turnover under $10 million (s 23 of the ACL).
• Privacy: the Privacy Act 1988 (Cth) applies to APP entities, broadly businesses with an annual turnover above $3 million, though smaller businesses can be covered where an exception applies, for example if they trade in personal information or provide health services (s 6D of the Privacy Act).

If your site is a blog or a directory with no checkout, the first of these can still apply to what your terms say, because advertising and site content can themselves be conduct in trade or commerce.

Keep the terms accurate: update when the business changes

The most obvious trigger for an update is a change in what you actually do. Fees, the range of products, delivery methods, the way returns are processed, new subscription features, a restructure that changes the legal entity behind the site, new markets you sell into: each of these should flow through to the terms, and each is a reason the old version no longer reflects reality.

The legal reason this matters is s 18 of the ACL. Terms and conditions are a representation about how you deal with customers, and a representation that is out of step with your actual practice can be misleading or deceptive. The Federal Court made the point in eBay International AG v Creative Festival Entertainment Pty Ltd [2006] FCA 1768. Ticket conditions for the Big Day Out festival said any ticket resold for profit would be cancelled, but the conditions had not been drawn to the attention of some purchasers at the time of sale. The Court found the conditions were not part of those contracts, and that the festival's claims that it would detect and cancel all such tickets were misleading. The lesson carries over directly to a website: state what you actually do, and update the statement when the practice changes.

Respect the consumer guarantees

Even a term that accurately describes your business can be void if it conflicts with the law. Section 64 of the ACL provides that any term of a contract is void to the extent it purports to exclude, restrict or modify the consumer guarantees. A "no refunds" clause, "all sales final" language, or a statement that goods are sold "as is" does not operate to the extent it contradicts the guarantees, no matter how clearly it is written.

This makes your refund and returns policy, which usually lives inside or next to the terms and conditions, one of the most important clauses to check. It is not enough that the policy is easy to find. It has to track the guarantees in substance, and a review is really a check that your refund language says what the law already requires. If a term purports to contract out of a guarantee, updating the terms means removing or rewriting that term, not defending it.

Screen for unfair terms

Section 23 of the ACL voids any term of a standard form consumer or small business contract that is unfair, while the rest of the contract continues to bind. Until late 2023, the practical consequence of an unfair term was mainly that it could not be enforced. That changed with the Treasury Laws Amendment (More Competition, Better Prices) Act 2022 (Cth), which commenced on 9 November 2023. Since then, proposing an unfair term in a standard form contract, or applying or relying on one, is itself a contravention that attracts pecuniary penalties (ss 23(2A) and (2C) of the ACL).

The ACCC publicly urged businesses to review their standard form contracts and remove unfair terms before those penalties took effect. That campaign is a reminder that law changes are a trigger for updating your terms even when your business has not moved. The clauses that typically cause trouble in website terms include unilateral variation clauses that let you change the terms without notice, automatic renewal of subscriptions without a reminder or easy exit, broad exclusions of liability, and one-sided termination rights. Each of these should be checked against the fairness factors in s 24 of the ACL, and against what your business actually does.

Keep the privacy policy up to date

If your business is an APP entity under the Privacy Act 1988 (Cth), Australian Privacy Principle 1 requires you to have a clearly expressed and up-to-date privacy policy about how you manage personal information. "Up to date" is the operative word. When your site changes how it handles data, the privacy policy must change with it: new analytics, cookies or advertising tags, email marketing lists, customer relationship tools, or sharing data with third parties are all changes that should be reflected.

The privacy policy is often a separate document from the terms and conditions, but it belongs in the same review. A common failure is updating the terms of sale while the privacy policy still describes an old set of data practices, leaving the site with a policy that is accurate in neither document.

Tell users when the terms change

An update only counts if it reaches the people it binds. Under general contract law, a term becomes part of a contract only if it is reasonably brought to the other party's attention before or at the time of contracting. eBay International AG v Creative Festival Entertainment Pty Ltd [2006] FCA 1768 is the illustration: conditions that were never drawn to purchasers' attention were not incorporated into their contracts, however clearly they appeared somewhere in the sales process.

The practical steps are straightforward. For new customers, a click-to-accept checkbox at checkout is the most reliable method of giving notice, because it is hard to argue someone did not see terms they had to acknowledge. For existing customers, a change to the wording on your site binds them only if it is brought to their attention: an email setting out the changed clauses and an effective date is the norm for material changes. Relying on a footer link is the weakest option, because a court may find the terms were never incorporated. Keep a version history and a record of which version each customer accepted, because a dispute will turn on which terms were in front of them when they contracted. Note also that a variation clause allowing you to change terms without notice may itself be unfair under s 23 of the ACL, so the notice mechanism should be drafted into the terms, not assumed.

Do not copy another site's terms

Copying the terms and conditions from another website is both a copyright problem and a practical one. Copyright subsists automatically in original literary works under s 32 of the Copyright Act 1968 (Cth), and a business's terms and conditions are its own literary work. Reproducing them without permission can amount to infringement, leaving you exposed to a claim from the very business whose terms you adopted.

The practical risk is often worse than the legal one. Another business's terms carry its assumptions: the wrong legal entity, refund language that reflects someone else's policy, and clauses drafted for a different market, including United States terms that directly contradict Australian consumer law. A copied clause that says refunds are discretionary is void under s 64 of the ACL. A copied clause that overstates your enforcement rights is a misleading conduct problem under s 18. If you copy, you inherit all of those defects and add a copyright claim on top.

What happens when terms go stale

The consequences of letting your terms drift are not hypothetical, and they compound:

• Void terms: Sections 64 and 23 of the ACL mean the clauses you rely on most, liability caps and refund carve-outs, simply do not operate when a dispute arises.
• Penalties: Section 224 of the ACL sets the scale: for a body corporate, up to the greater of $100 million, three times the benefit obtained, or 30 per cent of adjusted turnover, and up to $2.5 million for an individual. That scale applies to misleading conduct and to proposing or relying on unfair terms.
• Regulator action: The ACCC enforces the consumer guarantees and unfair contract terms regime, and the Office of the Australian Information Commissioner enforces the privacy obligations. Both can investigate without waiting for a customer complaint.
• Customer remedies: Consumers can seek compensation and other orders for loss caused by misleading conduct or void terms, and class actions over standard form terms are an established feature of Australian consumer law.
• Unenforceable terms: As the eBay case shows, a court will not enforce a term that was never brought to the other party's attention, whatever the website says.

A practical update checklist

Work through these when you review, at least once a year and whenever a trigger event occurs:

• Trigger events: price or fee changes, new products or features, changed delivery or refund processes, new data collection or third-party integrations, a restructure or name change, entering a new market, or a change in the law that affects consumer contracts.
• Refund clause: check that returns language matches the consumer guarantees and contains no "no refunds" style language (s 64 of the ACL).
• Unfair terms: screen variation clauses, automatic renewals, liability exclusions and termination rights (s 23 of the ACL).
• Privacy policy: update it whenever data practices change, and check it is linked from the terms (APP 1 of the Privacy Act 1988 (Cth)).
• Notice: use click-to-accept for new customers, and email existing customers about material changes with an effective date.
• Entity name: confirm the terms name the correct legal entity and ABN.
• Records: keep a version history and records of which version each customer accepted.
• Origin: do not copy from another site, and if you use a template, have it checked against your business before publishing.

When a lawyer should be involved

Most updates are routine, but there are points where professional help is worth the cost. A commercial lawyer should draft or review your terms if you are building them from scratch or converting a template, because the value of terms is in the details that templates get wrong. A lawyer should review the terms after significant law changes, as many businesses discovered with the unfair contract terms reforms of 9 November 2023, which turned previously unenforceable clauses into a source of penalties. Cross-border sales, a dispute with a customer about which version of the terms applies, an inquiry from a regulator, or uncertainty about whether a particular clause is unfair are all situations where an assessment from a lawyer is the efficient path. If you have already copied another business's terms, a lawyer can assess the copyright exposure and help you replace the terms properly rather than papering over them.

Read your own terms before your customers do

The honest answer to "how often should I update" is not a number. It is: whenever the business changes, whenever the law changes, and before you rely on a term against a customer. The step that gets skipped most is the last one. A term you changed in March binds nobody who agreed to the old version in February unless you told them, and the version that governs a dispute is the one that was in front of the customer when they contracted, not the one you intended to be current.

If you do nothing else this week, open your terms and check two things. First, the refund clause against how you actually handle returns. Second, the name of the entity at the top against your current business structure. Those two mismatches cause more trouble than any missed review date, and fixing them is the fastest way to make your terms match the business they are supposed to describe.