You have probably been here: a template for website terms and conditions downloaded from somewhere, or a draft a colleague found online, sitting open beside a "launch website" task on your list. Or you are mid-build, wiring an "I agree" checkbox into your checkout and wondering what the terms behind that box should actually say.
Website terms and conditions are the contract between your business and everyone who visits, registers on or buys through your site. They sit alongside your Privacy Policy, which handles personal information, and your Terms of Sale, which handles each transaction if you sell online. The terms set the ground rules for using the site itself: who owns what, what users may do, how far your liability runs, and what happens when something goes wrong. They bind everyone who uses the site, and they bind you to whatever you promise in them.
The clauses that carry the weight
The clauses below are the ones that do the work in a set of Australian website terms. Work through them in order, and treat each as a decision about your actual operations rather than a box to tick.
When the terms take effect
This clause decides when a visitor becomes bound. Common triggers are browsing the site, creating an account, ticking a box, or completing a purchase. The strongest trigger is an explicit "I agree" checkbox on registration or checkout, and best practice is to leave it unticked. The traps sit in the weaker triggers:
- Browsing alone: Terms that claim acceptance merely by visiting the site are the weakest form. Whether they bind a user can be disputed, and a court will ask whether you took reasonable steps to bring the terms to the user's attention before they acted.
- Buried links: A link in the footer that nobody scrolls to may not be enough for terms that create real obligations, particularly at the point of checkout.
- No record: If you cannot show when and how a user accepted, the clause is hard to enforce. Keep a time-stamped record of checkbox acceptances.
What users can and can't do
The permitted use clause lists what visitors may do with the site and what they may not: no unlawful activity, no scraping or data harvesting, no attempts to bypass security, no posting harmful or infringing content. It also gives you the right to suspend or terminate access when someone breaks the rules. Draft it against the abuse you actually see. For a content site that means copying and republishing; for a marketplace it means prohibited listings; for software it means reverse engineering and unauthorised redistribution.
Who owns the content
The intellectual property clause does two jobs. First, it states that your text, images, logos and code belong to you and that users receive only a limited, revocable licence to view and use them. Original content is protected by copyright automatically in Australia, and a registered trade mark protects your name or logo more broadly; the clause should say those marks may not be reproduced without permission. Second, if users upload content such as reviews, comments or photos, the clause sets out the licence you need to display and use that material, and when you may remove it. The drafting minimums are:
- A licence back from users: State what you may do with user uploads, such as display, moderate and promote them, and require users to warrant that they own or have rights in what they post.
- A right to remove: Give yourself a clear right to take down content that breaches the rules or the law, and state that you are not obliged to keep or return it.
- No implied assignment: If you want to own work created for you, say so. Under the Copyright Act 1968 (Cth), the creator is the first owner of copyright unless the work is made under employment or an assignment is in place.
How far your liability runs
The liability clause caps what you can be sued for: outages, errors in general information, third-party links, lost profits. But there is a statutory floor you cannot draft below. Under s 64 of the Australian Consumer Law (the ACL), which is Schedule 2 to the Competition and Consumer Act 2010 (Cth), any term of a contract that excludes, restricts or modifies the consumer guarantees is void to that extent. Your disclaimer can say the site is provided "as is", but it cannot tell a customer that goods you sell have no guarantee of acceptable quality. The traps to watch:
- "As is" overreach: An "as is" clause works for information published on the site, but not for goods or services you sell to consumers, where the ACL guarantees apply.
- Refund carve-outs: Wording like "no refunds" or "all sales final" is void to the extent it contradicts the ACL. Customers keep their remedies, such as repair, replacement or refund, when goods fail a consumer guarantee.
- One-sidedness: A liability clause that heavily favours you can itself be an unfair term. Under s 23 of the ACL, an unfair term in a standard form consumer or small business contract is void, and under s 24 a term is unfair if it causes a significant imbalance, is not reasonably necessary to protect the other party's legitimate interests, and would cause detriment.
Accounts, passwords and suspension
If users create accounts, set eligibility rules, require users to keep passwords confidential and report unauthorised use, and state when you may suspend or close accounts. Keep the suspension right connected to a breach of the terms rather than open-ended. The usual contents are:
- Eligibility: A minimum age and any restriction on who may hold an account.
- Security duties: What the user must do to protect their login, and their obligation to notify you of misuse.
- Suspension triggers: The conduct that lets you suspend or terminate access, and what happens to the user's data when an account closes.
Prices, payment and refunds
For an online store, the terms should cover pricing and whether it includes GST, how and when payment is taken, delivery and risk of loss, and returns. Many businesses put the transaction detail in a separate Terms of Sale and cross-reference it from the site terms, so customers see one clear set of sale rules at checkout. Whatever you write, it must sit inside the ACL: the consumer guarantees and the remedies attached to them are rights the customer keeps, and the terms cannot contract out of them.
Personal information and privacy
The privacy clause should state that personal information is handled in line with your Privacy Policy and link to it. Whether you are legally required to have a policy under the Privacy Act 1988 (Cth) depends on whether you are an APP entity. Broadly, a business is covered if its annual turnover exceeds $3 million. A small business operator, with turnover of $3 million or less in the previous financial year under s 6D of the Privacy Act, is exempt unless an exception applies; for example, businesses that provide health services or trade in personal information are covered regardless of turnover. If you are an APP entity, APP 1 requires a clearly expressed and up-to-date privacy policy. Two related drafting points:
- Marketing email: If you send commercial electronic messages to customers or prospects, the Spam Act 2003 (Cth) requires consent for the message under s 16, and a functional unsubscribe facility in every message under s 18, in addition to identifying who sent it.
- Consent records: Where you rely on consent for marketing or analytics, keep a record of when and how it was given, and make withdrawal as easy as giving it.
Cookies and tracking
If you use analytics, advertising pixels or remarketing, say so and link to a cookie notice that explains what is collected and why. The terms are a poor place for that detail; a short cookie policy in plain language works better, with the terms pointing to it. The point is not to hide the tracking but to make it findable from the same footer as the terms themselves.
Changing the terms
A variation clause reserves your right to update the terms. The drafting choice that matters is how you notify users of material changes. Updating the date alone is weak; emailing registered users, or requiring re-acceptance at the next login for material changes, is stronger. This clause has been a focus of the unfair contract terms regime. Since 9 November 2023, proposing, using or relying on an unfair term in a standard form contract is itself a contravention of the ACL, carrying penalties for a body corporate of the greater of $100 million, three times the benefit obtained, or 30% of adjusted turnover. A clause that lets you rewrite the terms with no notice and no way for the user to exit is exactly the kind of term regulators have targeted.
Governing law and disputes
Nominate an Australian state or territory as the governing law and set out the path for disputes: good faith discussion, then mediation, then the courts. This adds certainty and stops a user, or a court, from having to guess which regime applies. For a business selling nationally, choosing one state and making it explicit is usually better than silence.
Optional clauses that earn their place
Not every site needs every clause, but these earn their place when the trigger applies:
- Platform and marketplace rules: Include them if users list items, post jobs or transact with each other. Cover eligibility, listing standards, prohibited conduct, takedown and moderation.
- Subscription and auto-renewal terms: Include them if you bill on a cycle. Set renewal, cancellation and price-change notice clearly; automatic renewal clauses that trap users are on the regulators' radar.
- Developer and API terms: Include them if you expose an API or allow integrations. Cover usage limits, rate limits and API keys.
- International users: Include them if you sell or market overseas. State which country's laws apply to cross-border orders, delivery and tax treatment, and whether you accept orders from particular countries.
- Termination and survival: State what happens when an account ends, which clauses survive (typically IP, liability, governing law) and what happens to user data.
How an Artificer Legal lawyer would review your terms
When we review website terms at Artificer Legal, we start by reading the terms against the actual site flows: where acceptance happens, what the checkout page says, what emails get sent after sign-up, and how the privacy policy and cookie notice behave in practice. Terms that describe processes the business does not actually run create risk, not protection. Then we check the statutory floors. We push back on unilateral variation clauses without notice, automatic renewal without clear disclosure, blanket "no refunds" wording, liability caps that swallow the consumer guarantees, and indemnities from users that are broader than the business needs. We insist on explicit acceptance at every point of obligation, a full unfair contract terms pass over the document, a privacy policy matched to what the site actually collects, and consistency between the terms and what customer service and marketing staff promise. We would negotiate in that order: acceptance and liability first, then the unfair contract terms review, then the operational clauses.
The clause that makes the rest of the terms bite
Every other clause in your website terms only operates if the terms were validly brought home to the user. The acceptance clause is where well-drafted terms succeed and template terms fail. A template that says "by using this site you agree" and stops there looks complete, but when a dispute arrives the business cannot show the user ever agreed to anything. The version that works captures agreement at the moment of action: an unticked "I agree" checkbox at sign-up and checkout, a stored record of that acceptance, and the terms linked where the user is actually acting, not just in the footer. That single drafting choice decides whether your intellectual property, liability and suspension clauses are enforceable rights or decoration.
The rest follows from there. Website terms need to cover acceptance, permitted use, intellectual property, liability limits that respect the ACL consumer guarantees, accounts, payment and refunds, privacy, cookies, variation and disputes. They must sit inside the ACL, the Privacy Act and the Spam Act, which set floors the drafting cannot go below. And they need to be paired with a privacy policy, and with terms of sale if you transact online, so each document does one job clearly. Review them whenever your site changes, and particularly before you launch a subscription, a marketplace or any new way of collecting user data, because a set of terms drafted once and never revisited is usually a set of terms drafted before the business changed.