Do You Need a Privacy Policy and Terms of Service?

If you run a website or app, two legal pages do a lot of quiet work: a privacy policy and terms of service. They are easy to overlook until a user, an app store, or a regulator asks for them. Here is what each one does, why you almost certainly need both, and how to get them right.

Do you actually need them?

For a privacy policy, the answer is almost always yes. If your site collects any personal information — through a contact form, accounts, analytics, or advertising cookies — most privacy laws require one, and so do services like Google and the Apple and Google app stores.

Terms of service aren't always legally mandatory, but they are strongly recommended: they limit your liability, set rules you can enforce, clarify who owns what, and give you grounds to remove abusive users. If you sell anything or host user content, they are close to essential.

What a privacy policy covers

• What information you collect, and how you use it.
• Whether you use cookies, analytics, or advertising.
• Who you share data with, and how long you keep it.
• How you protect it, and how users can exercise their rights.

What terms of service cover

Terms set the rules for using your service: who may use it, what counts as acceptable use, who owns content, the limits of your liability, and how you can end someone's access. If you offer accounts, sales, subscriptions, or user-generated content, your terms should address each of those.

What's the difference?

In short: terms of service govern use of your service, while a privacy policy explains how you handle data. They serve different purposes, which is why most sites publish both and link to them in the footer.

Once your privacy policy is ready, generate the matching terms of service too — it takes a few minutes and the two are designed to sit side by side.