Most website owners treat terms and conditions as boilerplate — something you copy from a template, publish in the footer, and forget about. That's usually fine right up until it isn't: a user disputes a charge, someone reposts your content without permission, or a customer claims your service caused them a loss. At that point, whether your terms actually hold up matters a great deal, and a lot of copy-pasted templates don't.
Here's what a website's terms and conditions are actually meant to do, what Indian law expects from them, and where generic templates tend to fall short.
Terms and conditions are the contract between you and anyone using your website — the rules for using your platform, what you're responsible for, what you're not, and what happens if something goes wrong. Legally, they function as a binding agreement the moment a visitor accepts them, whether through an explicit checkbox or simply by continuing to use the site.
They're not the same as a privacy policy, even though people often lump the two together. Terms and conditions govern the relationship and usage rules; the privacy policy specifically covers how personal data is collected and handled. Both need to exist, and they need to be consistent with each other, but they're doing different jobs.
Strictly speaking, terms and conditions aren't mandated by a single overarching law the way, say, a privacy policy effectively is under India's data protection framework. But for a fairly large category of websites, specific disclosures are legally required, which in practice means you need a proper terms document anyway.
If you're running an e-commerce platform, the Consumer Protection (E-Commerce) Rules require you to disclose your legal name and address, customer service contact details, a grievance officer's information, and your return, refund, and cancellation policies — right there on the website, not buried in a PDF nobody reads. Skipping these isn't just bad practice; it's a violation of consumer protection law.
For platforms that host user-generated content — reviews, comments, forum posts, uploads — the IT Rules, 2021 (as amended) bring in additional obligations around content takedown, grievance redressal timelines, and, following more recent amendments, specific due diligence requirements for platforms using AI-generated content tools, including labelling obligations for synthetic or AI-generated material. If your platform touches any of this, your terms need to reflect it.
Acceptance of terms. How and when a user is considered to have agreed — by using the site, by creating an account, or by an explicit "I agree" action. Vague language here weakens your ability to enforce anything else in the document.
Intellectual property rights. Who owns the content on your site, what users are and aren't allowed to do with it, and — if your platform allows user uploads — what rights you're claiming over content users post. This last part is one of the most commonly mishandled clauses; being too aggressive about ownership of user content can itself create legal exposure.
User conduct and prohibited activities. What users can't do on your platform — this matters both for setting expectations and for giving you a documented basis to suspend or terminate accounts that violate it.
Limitation of liability. This is arguably the most commercially important clause in the whole document. A well-drafted version caps your liability to a defined amount, excludes indirect or consequential losses, and notes that things like technical outages or third-party content are outside your control. One thing worth flagging clearly: under Indian consumer protection law, you can't entirely exclude liability for deficiency in service, so a limitation clause needs to be realistic rather than absolute.
Payment and refund terms, if applicable — pricing, billing cycles, and cancellation conditions, written specifically enough that a dispute doesn't come down to interpretation.
Termination. The conditions under which you can suspend or terminate a user's access, and what happens to their data or content afterward.
Governing law and dispute resolution. Which state's jurisdiction applies and how disputes get resolved — arbitration, courts, or a defined escalation process.
Third-party links and content. A disclaimer that you're not responsible for external sites or services your platform links to, since users sometimes assume otherwise.
Cross-reference to your privacy policy. Given how much data-handling obligation now sits with the Digital Personal Data Protection Act, 2023, your terms should point clearly to your privacy policy rather than trying to duplicate its content — inconsistency between the two documents is a real liability, not just an oversight.
A free template pulled off the internet is written for no one in particular, which means it's often wrong for you in one of a few predictable ways:
There's no single law that mandates a generic terms document for every website, but specific disclosures are legally required for e-commerce platforms under the Consumer Protection (E-Commerce) Rules, and platforms hosting user content have additional obligations under the IT Rules. In practice, most businesses need a proper terms document either way.
Terms and conditions govern how users can use your website and the legal relationship between you and them. A privacy policy specifically covers how you collect, use, and protect personal data. Both are necessary, and they need to be consistent with each other.
Not entirely. Indian consumer protection law doesn't allow businesses to completely exclude liability for deficiency in service, so a limitation clause needs to be realistically drafted rather than treated as a blanket shield.
Yes. Under the Consumer Protection (E-Commerce) Rules, e-commerce platforms must disclose specific information, including their legal identity, grievance officer details, and return and refund policies, directly on the platform.
You can, but generic templates are often mismatched to a specific business model and can miss legally required disclosures or contain clauses that don't apply to you. For anything beyond a very simple informational site, a reviewed or customised document is worth the investment.
Whenever your business model, features, or applicable regulations change in a way that affects how users interact with your platform. A document that hasn't been touched in years is a common sign it no longer reflects how the business actually operates.